Akira_RestartManagerKill: Service Stop (T1489)

Before it opens a file, the encryptor checks whether another process holds the file. It does this per file with Restart Manager: RmStartSession, RmRegisterResources, RmGetList. Any holder that is not on a list of 20 protected system processes, built with WTSEnumerateProcessesW, is closed with RmShutdown(RmForceShutdown). This frees locked databases and documents so they can be encrypted.

Details: analysis/2026-10-11_101bd45ab673_akira-ransomware/03-static/03-pre-encryption-actions.md.

Code: not recreated. Detection: Detection/ (hunting notes).