One of our new Interns came across some insider threat activity.

Elliot Anderson has been detected hacking internal employee’s and we need to disable his account and look into his system. We also collected Disk images of all possible systems he could of touched and provided them on the Google Drive page. His system will show up as ecorpwin7-4

All VM OVA's https://drive.google.com/open?id=0Bz3L4ZnVlUY8X3VTUDRvOU9ZU3c