Investigators found that on November 22, while planning his extortion plot, Rhyne used his account on a hidden virtual machine to search the web for information on changing domain user passwords, deleting domain accounts, and clearing Windows logs.

Company account? Not the best idea.