Reading through the article, the "hacker" was pretty naive and junior, installing an EDR on his hacking box. Or it was just a way to distract you guys ;)
I caught that feeling through the whole article. Like, was this user really that distracted or inept to forget he installed a Huntress trial, or was this all for some larger, more insidious reason, or distraction?