It's a generic 0xf4 (google says check hardware) which it isn't hardware because it happens on whatever machine he is logged into (some being Virtual Box installs.

I was thinking the same thing you suggested. Gonna basically mimic his environment (machine name as well as log in) on a honey pot and see what happens from there.