Over the next few days, they observed that the script was indeed communicating with the remote server, but it seemed to be doing so in a way that was not malicious. It appeared to be checking the software's license and configuration, and then deactivating if the license was no longer valid.
The script seemed to be calling an executable file named "ATI2021.exe" with some activation parameters. But what was ATI2021, and why did it need to be activated? ATI2021-ActivationScript-2022.01.27.bat
He decided to do some research and reached out to his colleague, Alex, who was more experienced in IT. Alex explained that ATI2021 was a proprietary software tool used by the company for graphics rendering and other compute-intensive tasks. Over the next few days, they observed that