Forensics re: crypto mining software

We recently discovered that an employee was running cryptomining software on the computers in a training lab.  We have already determinedwho installed the software and when, but our CTO is wanting to know if there is a way we can prove that the employee profited from the activity (for HR purposes). Anybody have any suggestions for artifacts that would point me in the right direction, or is this a wild goose chase?