drop shd spool files evtx csv registry exports · print job history · printnightmare indicators · export csv · runs locally
print spool artifacts
drop spool / evtx / reg
or click
C:\Windows\System32\spool\PRINTERS\ · PrintService/Operational · Print\Monitors
drop .shd files, print service evtx csv, or registry export