21 User opens document named "1 - SHU LOCATOR 2019(HARDCOP4docx" from network location "\\NYMC_GRPS_SERVERWRPAGROUPASHAREDOC\SHU PAPERWORK, LOCATOR. HARDCOPYV 22 Execution of splwow64.exe by user BOP19012 indicates something was printed from the system 23 User launches Calculator (calc.exe) 24 User conti