Renamed AutoHotkey interpreter in temp/downloads/appdata with co-located same-named script and no args

Duo Tech@duotech

•updated Aug 5, 2026•3•1•18

Detects a renamed AutoHotkey interpreter executable (masquerading as another binary via its version-info OriginalFileName field) running from a Temp, Downloads, or AppData folder with no command-line arguments and a co-located, same-named .ahk script file created within an hour, consistent with the AutoHotkey stager technique used by UNC6692 to deploy the Edgecution malware suite.