[2026-08-19 04:59:51.5057544 | INF] KAPE directory: C:\Users\sgonk\Desktop\kape\KAPE
[2026-08-19 04:59:51.5378930 | INF] Command line:   --tsource C: --tdest C:\kape_out --tflush --target !BasicCollection,!SANS_Triage,ScheduledTasks,PowerShellConsole,Amcache,SRUM --msource C:\kape_out --mdest C:\kape_parsed --mflush --module !EZParser 
[2026-08-19 04:59:51.5378930 | INF] System info: Machine name: DESKTOP-V924VDR, 64-bit: true, User: jgartnet OS: "Windows10" (10.0.19045)
[2026-08-19 04:59:52.8038684 | INF] Using Target operations
[2026-08-19 04:59:52.8038684 | WRN]   Flushing target destination directory C:\kape_out
[2026-08-19 04:59:52.8038684 | WRN]   Creating target destination directory C:\kape_out
[2026-08-19 04:59:52.8204867 | INF] Found 6 targets. Expanding targets to file list...
[2026-08-19 04:59:55.2570324 | ERR] Target ApplicationEvents with Id 2da16dbf-ea47-448e-a00f-fc442c3109ba already processed. Skipping!
[2026-08-19 04:59:55.5242293 | ERR] Target EventLogs with Id d95784d9-bd1c-472b-aeef-de5d9ecc7aaa already processed. Skipping!
[2026-08-19 04:59:55.7238243 | ERR] Target PowerShellConsole with Id efa4332a-89eb-430c-ab61-006a9e6620d7 already processed. Skipping!
[2026-08-19 04:59:55.7396897 | ERR] Target USBDevicesLogs with Id 07ee308f-c79a-47de-a431-c93ab34e4b66 already processed. Skipping!
[2026-08-19 04:59:55.7396897 | ERR] Target EvidenceOfExecution with Id 13ba1e33-4899-4843-adf0-c7e6a20d758a already processed. Skipping!
[2026-08-19 04:59:55.7396897 | ERR] Target FileSystem with Id 2bd97ef7-5fbf-4427-8ca2-ffb15d545b00 already processed. Skipping!
[2026-08-19 04:59:55.7396897 | ERR] Target LNKFilesAndJumpLists with Id 2e354bdc-e418-438e-8439-c21c83c64e90 already processed. Skipping!
[2026-08-19 04:59:56.0723664 | ERR] Target RecycleBin_InfoFiles with Id 6205454f-fcaa-4ace-a7b5-33c4e40b156a already processed. Skipping!
[2026-08-19 04:59:56.0882784 | ERR] Target RegistryHives with Id 76af6086-bd0b-429f-bfd7-4a8e8ff8138f already processed. Skipping!
[2026-08-19 04:59:56.1198346 | ERR] Target ApplicationEvents with Id 2da16dbf-ea47-448e-a00f-fc442c3109ba already processed. Skipping!
[2026-08-19 04:59:56.1662960 | ERR] Target ApplicationEvents with Id 2da16dbf-ea47-448e-a00f-fc442c3109ba already processed. Skipping!
[2026-08-19 04:59:56.2818150 | ERR] Target ApplicationEvents with Id 2da16dbf-ea47-448e-a00f-fc442c3109ba already processed. Skipping!
[2026-08-19 04:59:56.3133038 | ERR] Target ApplicationEvents with Id 2da16dbf-ea47-448e-a00f-fc442c3109ba already processed. Skipping!
[2026-08-19 04:59:56.3288496 | ERR] Target ScheduledTasks with Id e5dc4367-2e6b-49bf-a90a-d4c1598bbe28 already processed. Skipping!
[2026-08-19 04:59:56.3288496 | ERR] Target SRUM with Id 9858f1fc-5e22-46a0-8bfd-c821ac9b4a13 already processed. Skipping!
[2026-08-19 04:59:56.3288496 | ERR] Target ThumbCache with Id 1eec8849-b6eb-475b-a700-f4fb0055356d already processed. Skipping!
[2026-08-19 05:00:03.6111072 | ERR] Target WindowsIndexSearch with Id 9828b927-f955-464a-80fb-a48ce0101236 already processed. Skipping!
[2026-08-19 05:00:03.7360735 | ERR] Target ScheduledTasks with Id e5dc4367-2e6b-49bf-a90a-d4c1598bbe28 already processed. Skipping!
[2026-08-19 05:00:03.7360735 | ERR] Target PowerShellConsole with Id efa4332a-89eb-430c-ab61-006a9e6620d7 already processed. Skipping!
[2026-08-19 05:00:03.7360735 | ERR] Target Amcache with Id 13ba1e33-4899-4843-adf1-c7e6b20d759a already processed. Skipping!
[2026-08-19 05:00:03.7360735 | ERR] Target SRUM with Id 9858f1fc-5e22-46a0-8bfd-c821ac9b4a13 already processed. Skipping!
[2026-08-19 05:00:03.7675540 | INF] Found 1,309 files in 10.944 seconds. Beginning copy...
[2026-08-19 05:00:23.2735024 | INF]   Deferring C:\Windows\System32\winevt\logs\Application.evtx due to IOException...
[2026-08-19 05:00:23.3048701 | INF]   Deferring C:\Windows\System32\winevt\logs\HardwareEvents.evtx due to IOException...
[2026-08-19 05:00:23.3048701 | INF]   Deferring C:\Windows\System32\winevt\logs\Internet Explorer.evtx due to IOException...
[2026-08-19 05:00:23.3204851 | INF]   Deferring C:\Windows\System32\winevt\logs\Key Management Service.evtx due to IOException...
[2026-08-19 05:00:23.3515827 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Client-License-ESU%4Admin.evtx due to IOException...
[2026-08-19 05:00:23.5127509 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Client-Licensing-Platform%4Admin.evtx due to IOException...
[2026-08-19 05:00:23.5280453 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-AAD%4Operational.evtx due to IOException...
[2026-08-19 05:00:23.5336651 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx due to IOException...
[2026-08-19 05:00:23.7391587 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-AppModel-Runtime%4Admin.evtx due to IOException...
[2026-08-19 05:00:23.7391587 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-AppReadiness%4Admin.evtx due to IOException...
[2026-08-19 05:00:23.7391587 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-AppReadiness%4Operational.evtx due to IOException...
[2026-08-19 05:00:23.7391587 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-AppXDeployment%4Operational.evtx due to IOException...
[2026-08-19 05:00:23.7391587 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-AppXDeployment-Server%4Operational.evtx due to IOException...
[2026-08-19 05:00:23.7551588 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx due to IOException...
[2026-08-19 05:00:23.7551588 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx due to IOException...
[2026-08-19 05:00:23.7551588 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-AppxPackaging%4Operational.evtx due to IOException...
[2026-08-19 05:00:24.0662596 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx due to IOException...
[2026-08-19 05:00:24.0662596 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-Biometrics%4Operational.evtx due to IOException...
[2026-08-19 05:00:24.0662596 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-BitLocker%4BitLocker Management.evtx due to IOException...
[2026-08-19 05:00:24.0662596 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-Bits-Client%4Operational.evtx due to IOException...
[2026-08-19 05:00:24.0662596 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-CloudRestoreLauncher%4Operational.evtx due to IOException...
[2026-08-19 05:00:24.0817834 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-CloudStore%4Initialization.evtx due to IOException...
[2026-08-19 05:00:24.0817834 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-CloudStore%4Operational.evtx due to IOException...
[2026-08-19 05:00:24.0817834 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-CodeIntegrity%4Operational.evtx due to IOException...
[2026-08-19 05:00:24.0817834 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-Containers-BindFlt%4Operational.evtx due to IOException...
[2026-08-19 05:00:24.0817834 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-Containers-Wcifs%4Operational.evtx due to IOException...
[2026-08-19 05:00:24.1755882 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx due to IOException...
[2026-08-19 05:00:24.1911535 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx due to IOException...
[2026-08-19 05:00:24.1911535 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-Crypto-NCrypt%4Operational.evtx due to IOException...
[2026-08-19 05:00:24.1911535 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx due to IOException...
[2026-08-19 05:00:24.1911535 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Enrollment.evtx due to IOException...
[2026-08-19 05:00:24.1911535 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Operational.evtx due to IOException...
[2026-08-19 05:00:24.2067618 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Sync.evtx due to IOException...
[2026-08-19 05:00:24.3468418 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-DeviceSetupManager%4Operational.evtx due to IOException...
[2026-08-19 05:00:24.3468418 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-Dhcp-Client%4Admin.evtx due to IOException...
[2026-08-19 05:00:24.3468418 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx due to IOException...
[2026-08-19 05:00:24.3468418 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx due to IOException...
[2026-08-19 05:00:24.3468418 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-Diagnosis-Scheduled%4Operational.evtx due to IOException...
[2026-08-19 05:00:24.3623570 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-Diagnosis-Scripted%4Admin.evtx due to IOException...
[2026-08-19 05:00:24.3623570 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-Diagnosis-Scripted%4Operational.evtx due to IOException...
[2026-08-19 05:00:24.3623570 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx due to IOException...
[2026-08-19 05:00:24.3623570 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-FileHistory-Core%4WHC.evtx due to IOException...
[2026-08-19 05:00:24.3752713 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-GroupPolicy%4Operational.evtx due to IOException...
[2026-08-19 05:00:24.3764582 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-HelloForBusiness%4Operational.evtx due to IOException...
[2026-08-19 05:00:24.3799458 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-HotspotAuth%4Operational.evtx due to IOException...
[2026-08-19 05:00:24.5517836 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-Kernel-Boot%4Operational.evtx due to IOException...
[2026-08-19 05:00:24.5517836 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx due to IOException...
[2026-08-19 05:00:24.7396872 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx due to IOException...
[2026-08-19 05:00:24.7396872 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx due to IOException...
[2026-08-19 05:00:24.7396872 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx due to IOException...
[2026-08-19 05:00:24.7396872 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-Kernel-WHEA%4Errors.evtx due to IOException...
[2026-08-19 05:00:24.7551900 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-Kernel-WHEA%4Operational.evtx due to IOException...
[2026-08-19 05:00:24.7551900 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-Known Folders API Service.evtx due to IOException...
[2026-08-19 05:00:24.7551900 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-LanguagePackSetup%4Operational.evtx due to IOException...
[2026-08-19 05:00:24.7551900 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-LAPS%4Operational.evtx due to IOException...
[2026-08-19 05:00:24.7551900 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-LiveId%4Operational.evtx due to IOException...
[2026-08-19 05:00:25.0481065 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-NCSI%4Operational.evtx due to IOException...
[2026-08-19 05:00:25.0481065 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-NetworkProfile%4Operational.evtx due to IOException...
[2026-08-19 05:00:25.0634989 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-Ntfs%4Operational.evtx due to IOException...
[2026-08-19 05:00:25.0634989 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-Ntfs%4WHC.evtx due to IOException...
[2026-08-19 05:00:25.0634989 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-Partition%4Diagnostic.evtx due to IOException...
[2026-08-19 05:00:25.0634989 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-PowerShell%4Admin.evtx due to IOException...
[2026-08-19 05:00:25.0634989 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-PowerShell%4Operational.evtx due to IOException...
[2026-08-19 05:00:25.0634989 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-Privacy-Auditing%4Operational.evtx due to IOException...
[2026-08-19 05:00:25.0950028 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx due to IOException...
[2026-08-19 05:00:25.0950028 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-Provisioning-Diagnostics-Provider%4Admin.evtx due to IOException...
[2026-08-19 05:00:25.0950028 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-Provisioning-Diagnostics-Provider%4AutoPilot.evtx due to IOException...
[2026-08-19 05:00:25.0950028 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-Provisioning-Diagnostics-Provider%4ManagementService.evtx due to IOException...
[2026-08-19 05:00:25.1103572 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-PushNotification-Platform%4Admin.evtx due to IOException...
[2026-08-19 05:00:25.1103572 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-PushNotification-Platform%4Operational.evtx due to IOException...
[2026-08-19 05:00:25.1103572 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-ReadyBoost%4Operational.evtx due to IOException...
[2026-08-19 05:00:25.1260264 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-RemoteAssistance%4Admin.evtx due to IOException...
[2026-08-19 05:00:25.1260264 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-RemoteAssistance%4Operational.evtx due to IOException...
[2026-08-19 05:00:25.1260264 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx due to IOException...
[2026-08-19 05:00:25.1260264 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-Resource-Exhaustion-Resolver%4Operational.evtx due to IOException...
[2026-08-19 05:00:25.1415612 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-RestartManager%4Operational.evtx due to IOException...
[2026-08-19 05:00:25.1576196 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-Security-LessPrivilegedAppContainer%4Operational.evtx due to IOException...
[2026-08-19 05:00:25.1576196 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-Security-Mitigations%4KernelMode.evtx due to IOException...
[2026-08-19 05:00:25.1887394 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-Security-SPP-UX-Notifications%4ActionCenter.evtx due to IOException...
[2026-08-19 05:00:25.1887394 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-SettingSync%4Debug.evtx due to IOException...
[2026-08-19 05:00:25.1887394 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-SettingSync%4Operational.evtx due to IOException...
[2026-08-19 05:00:25.1887394 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-Shell-ConnectedAccountState%4ActionCenter.evtx due to IOException...
[2026-08-19 05:00:25.1887394 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-Shell-Core%4ActionCenter.evtx due to IOException...
[2026-08-19 05:00:25.2045244 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-Shell-Core%4AppDefaults.evtx due to IOException...
[2026-08-19 05:00:25.2045244 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-Shell-Core%4LogonTasksChannel.evtx due to IOException...
[2026-08-19 05:00:25.2045244 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-Shell-Core%4Operational.evtx due to IOException...
[2026-08-19 05:00:25.2045244 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-ShellCommon-StartLayoutPopulation%4Operational.evtx due to IOException...
[2026-08-19 05:00:25.2045244 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-SmbClient%4Audit.evtx due to IOException...
[2026-08-19 05:00:25.2201448 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-SmbClient%4Connectivity.evtx due to IOException...
[2026-08-19 05:00:25.2201448 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-SMBClient%4Operational.evtx due to IOException...
[2026-08-19 05:00:25.2201448 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-SmbClient%4Security.evtx due to IOException...
[2026-08-19 05:00:25.2352732 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-SMBServer%4Audit.evtx due to IOException...
[2026-08-19 05:00:25.2352732 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-SMBServer%4Connectivity.evtx due to IOException...
[2026-08-19 05:00:25.2352732 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-SMBServer%4Operational.evtx due to IOException...
[2026-08-19 05:00:25.2352732 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-SMBServer%4Security.evtx due to IOException...
[2026-08-19 05:00:25.2352732 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-StateRepository%4Operational.evtx due to IOException...
[2026-08-19 05:00:25.2512286 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-StateRepository%4Restricted.evtx due to IOException...
[2026-08-19 05:00:25.2664896 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-Storage-Storport%4Health.evtx due to IOException...
[2026-08-19 05:00:25.2664896 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-Storage-Storport%4Operational.evtx due to IOException...
[2026-08-19 05:00:25.2664896 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-StorageSpaces-Driver%4Diagnostic.evtx due to IOException...
[2026-08-19 05:00:25.2824594 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-StorageSpaces-Driver%4Operational.evtx due to IOException...
[2026-08-19 05:00:25.2824594 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-StorageSpaces-ManagementAgent%4WHC.evtx due to IOException...
[2026-08-19 05:00:25.2824594 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-Store%4Operational.evtx due to IOException...
[2026-08-19 05:00:25.2824594 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-Storsvc%4Diagnostic.evtx due to IOException...
[2026-08-19 05:00:25.2979621 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-Sysmon%4Operational.evtx due to IOException...
[2026-08-19 05:00:25.2979621 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-TaskScheduler%4Maintenance.evtx due to IOException...
[2026-08-19 05:00:25.2979621 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-TaskScheduler%4Operational.evtx due to IOException...
[2026-08-19 05:00:25.3763071 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx due to IOException...
[2026-08-19 05:00:25.3771193 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx due to IOException...
[2026-08-19 05:00:25.3811373 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-Time-Service%4Operational.evtx due to IOException...
[2026-08-19 05:00:25.4364246 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-TZSync%4Operational.evtx due to IOException...
[2026-08-19 05:00:25.5170900 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-UniversalTelemetryClient%4Operational.evtx due to IOException...
[2026-08-19 05:00:25.5170900 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-User Device Registration%4Admin.evtx due to IOException...
[2026-08-19 05:00:25.5170900 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-User Profile Service%4Operational.evtx due to IOException...
[2026-08-19 05:00:25.5539611 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-UserPnp%4ActionCenter.evtx due to IOException...
[2026-08-19 05:00:25.6884521 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx due to IOException...
[2026-08-19 05:00:25.7369135 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-Wcmsvc%4Operational.evtx due to IOException...
[2026-08-19 05:00:25.7369135 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-WebAuthN%4Operational.evtx due to IOException...
[2026-08-19 05:00:25.7522967 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-WER-PayloadHealth%4Operational.evtx due to IOException...
[2026-08-19 05:00:25.7996047 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-Windows Defender%4Operational.evtx due to IOException...
[2026-08-19 05:00:25.7996047 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-Windows Defender%4WHC.evtx due to IOException...
[2026-08-19 05:00:25.7996047 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx due to IOException...
[2026-08-19 05:00:25.7996047 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx due to IOException...
[2026-08-19 05:00:25.7996047 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-Windows Firewall With Advanced Security%4FirewallDiagnostics.evtx due to IOException...
[2026-08-19 05:00:25.8150480 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-WindowsBackup%4ActionCenter.evtx due to IOException...
[2026-08-19 05:00:25.8150480 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-WindowsSystemAssessmentTool%4Operational.evtx due to IOException...
[2026-08-19 05:00:25.8150480 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-WindowsUpdateClient%4Operational.evtx due to IOException...
[2026-08-19 05:00:25.8801185 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx due to IOException...
[2026-08-19 05:00:25.8801185 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-Winlogon%4Operational.evtx due to IOException...
[2026-08-19 05:00:25.8801185 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-WinRM%4Operational.evtx due to IOException...
[2026-08-19 05:00:25.8801185 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-WMI-Activity%4Operational.evtx due to IOException...
[2026-08-19 05:00:25.8956924 | INF]   Deferring C:\Windows\System32\winevt\logs\Microsoft-Windows-WorkFolders%4WHC.evtx due to IOException...
[2026-08-19 05:00:25.9210247 | INF]   Deferring C:\Windows\System32\winevt\logs\Parameters.evtx due to IOException...
[2026-08-19 05:00:25.9210247 | INF]   Deferring C:\Windows\System32\winevt\logs\Security.evtx due to IOException...
[2026-08-19 05:00:25.9210247 | INF]   Deferring C:\Windows\System32\winevt\logs\Setup.evtx due to IOException...
[2026-08-19 05:00:25.9383320 | INF]   Deferring C:\Windows\System32\winevt\logs\State.evtx due to IOException...
[2026-08-19 05:00:25.9383320 | INF]   Deferring C:\Windows\System32\winevt\logs\System.evtx due to IOException...
[2026-08-19 05:00:25.9383320 | INF]   Deferring C:\Windows\System32\winevt\logs\Windows PowerShell.evtx due to IOException...
[2026-08-19 05:00:35.8776370 | INF]   Deferring C:\Windows\AppCompat\Programs\Amcache.hve due to IOException...
[2026-08-19 05:00:35.8776370 | INF]   Deferring C:\Windows\AppCompat\Programs\Amcache.hve.LOG1 due to IOException...
[2026-08-19 05:00:35.8933693 | INF]   Deferring C:\Windows\AppCompat\Programs\Amcache.hve.LOG2 due to IOException...
[2026-08-19 05:00:35.8933693 | INF]   Deferring C:\$MFT due to UnauthorizedAccessException...
[2026-08-19 05:00:35.8933693 | INF]   Deferring C:\$LogFile due to UnauthorizedAccessException...
[2026-08-19 05:00:35.9401994 | INF]   Deferring C:\$Extend\$UsnJrnl:$J due to NotSupportedException...
[2026-08-19 05:00:35.9401994 | INF]   Deferring C:\$Extend\$UsnJrnl:$Max due to NotSupportedException...
[2026-08-19 05:00:35.9401994 | INF]   Deferring C:\$Secure:$SDS due to NotSupportedException...
[2026-08-19 05:00:35.9401994 | INF]   Deferring C:\$Boot due to UnauthorizedAccessException...
[2026-08-19 05:00:35.9872975 | INF]   Deferring C:\$Extend\$RmMetadata\$TxfLog\$Tops:$T due to NotSupportedException...
[2026-08-19 05:00:37.8133817 | INF]   Deferring C:\Windows\System32\config\SAM.LOG1 due to IOException...
[2026-08-19 05:00:37.8133817 | INF]   Deferring C:\Windows\System32\config\SAM.LOG2 due to IOException...
[2026-08-19 05:00:37.8133817 | INF]   Deferring C:\Windows\System32\config\SECURITY.LOG1 due to IOException...
[2026-08-19 05:00:37.8133817 | INF]   Deferring C:\Windows\System32\config\SECURITY.LOG2 due to IOException...
[2026-08-19 05:00:37.8133817 | INF]   Deferring C:\Windows\System32\config\SOFTWARE.LOG1 due to IOException...
[2026-08-19 05:00:37.8133817 | INF]   Deferring C:\Windows\System32\config\SOFTWARE.LOG2 due to IOException...
[2026-08-19 05:00:37.8289271 | INF]   Deferring C:\Windows\System32\config\SYSTEM.LOG1 due to IOException...
[2026-08-19 05:00:37.8289271 | INF]   Deferring C:\Windows\System32\config\SYSTEM.LOG2 due to IOException...
[2026-08-19 05:00:37.8289271 | INF]   Deferring C:\Windows\System32\config\SAM due to IOException...
[2026-08-19 05:00:37.8289271 | INF]   Deferring C:\Windows\System32\config\SECURITY due to IOException...
[2026-08-19 05:00:37.8443934 | INF]   Deferring C:\Windows\System32\config\SOFTWARE due to IOException...
[2026-08-19 05:00:37.8443934 | INF]   Deferring C:\Windows\System32\config\SYSTEM due to IOException...
[2026-08-19 05:00:37.8443934 | INF]   Deferring C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT due to IOException...
[2026-08-19 05:00:37.8443934 | INF]   Deferring C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT.LOG1 due to IOException...
[2026-08-19 05:00:37.8601920 | INF]   Deferring C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT.LOG2 due to IOException...
[2026-08-19 05:00:37.8601920 | INF]   Deferring C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT due to IOException...
[2026-08-19 05:00:37.8601920 | INF]   Deferring C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT.LOG1 due to IOException...
[2026-08-19 05:00:37.8601920 | INF]   Deferring C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT.LOG2 due to IOException...
[2026-08-19 05:00:38.0320273 | INF]   Deferring C:\Users\jgartnet\NTUSER.DAT due to IOException...
[2026-08-19 05:00:38.0320273 | INF]   Deferring C:\Users\sgonk\NTUSER.DAT due to IOException...
[2026-08-19 05:00:38.5101273 | INF]   Deferring C:\Users\jgartnet\ntuser.dat.LOG1 due to IOException...
[2026-08-19 05:00:38.5101273 | INF]   Deferring C:\Users\jgartnet\ntuser.dat.LOG2 due to IOException...
[2026-08-19 05:00:38.5101273 | INF]   Deferring C:\Users\sgonk\ntuser.dat.LOG1 due to IOException...
[2026-08-19 05:00:38.5256829 | INF]   Deferring C:\Users\sgonk\ntuser.dat.LOG2 due to IOException...
[2026-08-19 05:00:38.6287716 | INF]   Deferring C:\Windows\System32\config\DEFAULT due to IOException...
[2026-08-19 05:00:38.6287716 | INF]   Deferring C:\Windows\System32\config\DEFAULT.LOG1 due to IOException...
[2026-08-19 05:00:38.6287716 | INF]   Deferring C:\Windows\System32\config\DEFAULT.LOG2 due to IOException...
[2026-08-19 05:00:38.7377375 | INF]   Deferring C:\Users\jgartnet\AppData\Local\Microsoft\Windows\UsrClass.dat due to IOException...
[2026-08-19 05:00:38.7532717 | INF]   Deferring C:\Users\sgonk\AppData\Local\Microsoft\Windows\UsrClass.dat due to IOException...
[2026-08-19 05:00:39.0190853 | INF]   Deferring C:\Users\jgartnet\AppData\Local\Microsoft\Windows\UsrClass.dat.LOG1 due to IOException...
[2026-08-19 05:00:39.0190853 | INF]   Deferring C:\Users\jgartnet\AppData\Local\Microsoft\Windows\UsrClass.dat.LOG2 due to IOException...
[2026-08-19 05:00:39.0500146 | INF]   Deferring C:\Users\sgonk\AppData\Local\Microsoft\Windows\UsrClass.dat.LOG1 due to IOException...
[2026-08-19 05:00:39.0500146 | INF]   Deferring C:\Users\sgonk\AppData\Local\Microsoft\Windows\UsrClass.dat.LOG2 due to IOException...
[2026-08-19 05:00:41.3810137 | INF]   Deferring C:\Windows\System32\Tasks\Microsoft\Windows\GroupPolicy\{3E0A038B-D834-4930-9981-E89C9BFF83AA} due to UnauthorizedAccessException...
[2026-08-19 05:00:41.3818744 | INF]   Deferring C:\Windows\System32\Tasks\Microsoft\Windows\GroupPolicy\{A7719E0F-10DB-4640-AD8C-490CC6AD5202} due to UnauthorizedAccessException...
[2026-08-19 05:00:47.1554022 | INF]   Deferring C:\Users\jgartnet\AppData\Local\Microsoft\Windows\Explorer\thumbcache_256.db due to IOException...
[2026-08-19 05:00:47.1712637 | INF]   Deferring C:\Users\jgartnet\AppData\Local\Microsoft\Windows\Explorer\thumbcache_48.db due to IOException...
[2026-08-19 05:00:47.1712637 | INF]   Deferring C:\Users\jgartnet\AppData\Local\Microsoft\Windows\Explorer\thumbcache_96.db due to IOException...
[2026-08-19 05:00:47.1712637 | INF]   Deferring C:\Users\jgartnet\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db due to IOException...
[2026-08-19 05:00:47.2181878 | INF]   Deferring C:\Users\sgonk\AppData\Local\Microsoft\Windows\Explorer\thumbcache_16.db due to IOException...
[2026-08-19 05:00:47.2181878 | INF]   Deferring C:\Users\sgonk\AppData\Local\Microsoft\Windows\Explorer\thumbcache_256.db due to IOException...
[2026-08-19 05:00:47.2181878 | INF]   Deferring C:\Users\sgonk\AppData\Local\Microsoft\Windows\Explorer\thumbcache_32.db due to IOException...
[2026-08-19 05:00:47.2181878 | INF]   Deferring C:\Users\sgonk\AppData\Local\Microsoft\Windows\Explorer\thumbcache_48.db due to IOException...
[2026-08-19 05:00:47.2335108 | INF]   Deferring C:\Users\sgonk\AppData\Local\Microsoft\Windows\Explorer\thumbcache_96.db due to IOException...
[2026-08-19 05:00:47.2335108 | INF]   Deferring C:\Users\sgonk\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db due to IOException...
[2026-08-19 05:00:48.2489247 | INF]   Deferring C:\programdata\microsoft\search\data\applications\windows\edb.jtx due to IOException...
[2026-08-19 05:00:48.3429143 | INF]   Deferring C:\programdata\microsoft\search\data\applications\windows\edbtmp.jtx due to IOException...
[2026-08-19 05:00:48.3586171 | INF]   Deferring C:\programdata\microsoft\search\data\applications\windows\Windows.edb due to IOException...
[2026-08-19 05:00:48.3586171 | INF]   Deferring C:\programdata\microsoft\search\data\applications\windows\Windows.jfm due to IOException...
[2026-08-19 05:00:48.5678517 | INF]   Deferring C:\programdata\microsoft\search\data\applications\windows\GatherLogs\SystemIndex\SystemIndex.8.Crwl due to IOException...
[2026-08-19 05:00:48.5678517 | INF]   Deferring C:\programdata\microsoft\search\data\applications\windows\GatherLogs\SystemIndex\SystemIndex.8.gthr due to IOException...
[2026-08-19 05:00:48.5993574 | INF]   Deferring C:\ProgramData\Microsoft\Windows Defender\Support\MPDetection-20260808-150351.log due to IOException...
[2026-08-19 05:00:48.6154783 | INF]   Deferring C:\ProgramData\Microsoft\Windows Defender\Support\MPDeviceControl-20260809-015250.log due to IOException...
[2026-08-19 05:00:48.6154783 | INF]   Deferring C:\ProgramData\Microsoft\Windows Defender\Support\MPLog-20260808-150351.log due to IOException...
[2026-08-19 05:00:48.6154783 | INF]   Deferring C:\ProgramData\Microsoft\Windows Defender\Support\MPScanSkip-20260809-015250.log due to IOException...
[2026-08-19 05:00:48.7770865 | INF]   Deferring C:\ProgramData\Microsoft\Windows Defender\Support\MpWppCoreTracing-20260817-204110-00000003-100000000.bin due to IOException...
[2026-08-19 05:00:50.0780271 | INF]   Deferring C:\ProgramData\Microsoft\Windows Defender\Support\MpWppTracing-20260818-014111-00000003-fffffffeffffffff.bin due to IOException...
[2026-08-19 05:00:50.4898402 | INF]   Deferring C:\ProgramData\Microsoft\Windows Defender\Support\MpWppUpdateLogging-20260817-204110.bin due to IOException...
[2026-08-19 05:00:51.6786840 | INF]   Deferring C:\Users\sgonk\AppData\Local\Microsoft\OneDrive\logs\Common\FileCoAuth-2026-08-19.0943.2764.2.aodl due to IOException...
[2026-08-19 05:00:52.6398151 | INF]   Deferring C:\Users\sgonk\AppData\Local\Microsoft\OneDrive\logs\Personal\SyncEngine-2026-08-19.0930.4828.4.aodl due to IOException...
[2026-08-19 05:00:52.6398151 | INF]   Deferring C:\Users\sgonk\AppData\Local\Microsoft\OneDrive\logs\Personal\telemetryCache.otc due to IOException...
[2026-08-19 05:00:52.6659242 | INF]   Deferring C:\Users\sgonk\AppData\Local\Microsoft\OneDrive\logs\Personal\telemetryCache.otc-shm due to IOException...
[2026-08-19 05:00:52.6694317 | INF]   Deferring C:\Users\sgonk\AppData\Local\Microsoft\OneDrive\logs\Personal\telemetryCache.otc-wal due to IOException...
[2026-08-19 05:00:52.6865787 | INF]   Deferring C:\Users\sgonk\AppData\Local\Microsoft\OneDrive\logs\ListSync\Business1\microsoftNucleusTelemetryCache.otc due to IOException...
[2026-08-19 05:00:52.6865787 | INF]   Deferring C:\Users\sgonk\AppData\Local\Microsoft\OneDrive\logs\ListSync\Business1\microsoftNucleusTelemetryCache.otc-shm due to IOException...
[2026-08-19 05:00:52.6865787 | INF]   Deferring C:\Users\sgonk\AppData\Local\Microsoft\OneDrive\logs\ListSync\Business1\microsoftNucleusTelemetryCache.otc-wal due to IOException...
[2026-08-19 05:00:52.7107222 | INF]   Deferring C:\Users\sgonk\AppData\Local\Microsoft\OneDrive\logs\ListSync\Business1\NucleusBusiness-2026-08-18.1001.8104.1.aodl due to IOException...
[2026-08-19 05:00:52.7383006 | INF]   Deferring C:\Users\sgonk\AppData\Local\Microsoft\OneDrive\logs\ListSync\Common\microsoftNucleusTelemetryCache.otc due to IOException...
[2026-08-19 05:00:52.7536808 | INF]   Deferring C:\Users\sgonk\AppData\Local\Microsoft\OneDrive\logs\ListSync\Common\microsoftNucleusTelemetryCache.otc-shm due to IOException...
[2026-08-19 05:00:52.7536808 | INF]   Deferring C:\Users\sgonk\AppData\Local\Microsoft\OneDrive\logs\ListSync\Common\microsoftNucleusTelemetryCache.otc-wal due to IOException...
[2026-08-19 05:00:52.8478024 | INF]   Deferring C:\Users\sgonk\AppData\Local\Microsoft\OneDrive\logs\ListSync\Common\Nucleus-2026-08-19.0241.8104.3.aodl due to IOException...
[2026-08-19 05:00:52.8944291 | INF]   Deferring C:\Users\sgonk\AppData\Local\Microsoft\OneDrive\logs\ListSync\Local\NucleusLocal-2026-08-18.1001.8104.1.aodl due to IOException...
[2026-08-19 05:00:52.9101610 | INF]   Deferring C:\Users\sgonk\AppData\Local\Microsoft\OneDrive\logs\ListSync\UnAuthenticated\microsoftNucleusTelemetryCache.otc due to IOException...
[2026-08-19 05:00:52.9101610 | INF]   Deferring C:\Users\sgonk\AppData\Local\Microsoft\OneDrive\logs\ListSync\UnAuthenticated\microsoftNucleusTelemetryCache.otc-shm due to IOException...
[2026-08-19 05:00:52.9101610 | INF]   Deferring C:\Users\sgonk\AppData\Local\Microsoft\OneDrive\logs\ListSync\UnAuthenticated\microsoftNucleusTelemetryCache.otc-wal due to IOException...
[2026-08-19 05:00:52.9255035 | INF]   Deferring C:\Users\sgonk\AppData\Local\Microsoft\OneDrive\logs\ListSync\UnAuthenticated\NucleusUnAuthenticated-2026-08-18.1001.8104.1.aodl due to IOException...
[2026-08-19 05:00:53.5932637 | INF]   Deferring C:\Users\sgonk\AppData\Local\Microsoft\OneDrive\settings\Personal\CxP.db due to IOException...
[2026-08-19 05:00:53.5932637 | INF]   Deferring C:\Users\sgonk\AppData\Local\Microsoft\OneDrive\settings\Personal\CxP.db-shm due to IOException...
[2026-08-19 05:00:53.6083523 | INF]   Deferring C:\Users\sgonk\AppData\Local\Microsoft\OneDrive\settings\Personal\CxP.db-wal due to IOException...
[2026-08-19 05:00:53.6866276 | INF]   Deferring C:\Users\sgonk\AppData\Local\Microsoft\OneDrive\settings\Personal\OCSI.db due to IOException...
[2026-08-19 05:00:53.6866276 | INF]   Deferring C:\Users\sgonk\AppData\Local\Microsoft\OneDrive\settings\Personal\OCSI.db-shm due to IOException...
[2026-08-19 05:00:53.6866276 | INF]   Deferring C:\Users\sgonk\AppData\Local\Microsoft\OneDrive\settings\Personal\OCSI.db-wal due to IOException...
[2026-08-19 05:00:53.6866276 | INF]   Deferring C:\Users\sgonk\AppData\Local\Microsoft\OneDrive\settings\Personal\SafeDelete.db due to IOException...
[2026-08-19 05:00:53.7023302 | INF]   Deferring C:\Users\sgonk\AppData\Local\Microsoft\OneDrive\settings\Personal\SafeDelete.db-shm due to IOException...
[2026-08-19 05:00:53.7023302 | INF]   Deferring C:\Users\sgonk\AppData\Local\Microsoft\OneDrive\settings\Personal\SafeDelete.db-wal due to IOException...
[2026-08-19 05:00:53.7218033 | INF]   Deferring C:\Users\sgonk\AppData\Local\Microsoft\OneDrive\settings\Personal\SettingsDatabase.db due to IOException...
[2026-08-19 05:00:53.7242352 | INF]   Deferring C:\Users\sgonk\AppData\Local\Microsoft\OneDrive\settings\Personal\SettingsDatabase.db-shm due to IOException...
[2026-08-19 05:00:53.7272263 | INF]   Deferring C:\Users\sgonk\AppData\Local\Microsoft\OneDrive\settings\Personal\SettingsDatabase.db-wal due to IOException...
[2026-08-19 05:00:53.7304770 | INF]   Deferring C:\Users\sgonk\AppData\Local\Microsoft\OneDrive\settings\Personal\SyncEngineDatabase.db due to IOException...
[2026-08-19 05:00:53.7304770 | INF]   Deferring C:\Users\sgonk\AppData\Local\Microsoft\OneDrive\settings\Personal\SyncEngineDatabase.db-shm due to IOException...
[2026-08-19 05:00:53.7304770 | INF]   Deferring C:\Users\sgonk\AppData\Local\Microsoft\OneDrive\settings\Personal\SyncEngineDatabase.db-wal due to IOException...
[2026-08-19 05:00:53.7464622 | INF]   Deferring C:\Users\sgonk\AppData\Local\Microsoft\OneDrive\settings\Personal\UXDatabase.db due to IOException...
[2026-08-19 05:00:55.4919901 | INF]   Deferring C:\Windows\System32\WDI\LogFiles\WdiContextLog.etl.003 due to IOException...
[2026-08-19 05:00:57.0074031 | INF]   Deferring C:\Windows\System32\LogFiles\WMI\LwtNetLog.etl due to IOException...
[2026-08-19 05:00:57.0233312 | INF]   Deferring C:\Windows\System32\LogFiles\WMI\Microsoft-Windows-Rdp-Graphics-RdpIdd-Trace.etl due to IOException...
[2026-08-19 05:00:57.0233312 | INF]   Deferring C:\Windows\System32\LogFiles\WMI\NetCore.etl due to IOException...
[2026-08-19 05:00:57.0233312 | INF]   Deferring C:\Windows\System32\LogFiles\WMI\NtfsLog.etl due to IOException...
[2026-08-19 05:00:57.0233312 | INF]   Deferring C:\Windows\System32\LogFiles\WMI\RadioMgr.etl due to IOException...
[2026-08-19 05:00:57.1481089 | INF]   Deferring C:\Windows\System32\LogFiles\WMI\Wifi.etl due to IOException...
[2026-08-19 05:00:57.1636388 | INF]   Deferring C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRT1DSListener.etl due to UnauthorizedAccessException...
[2026-08-19 05:00:57.1636388 | INF]   Deferring C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl due to UnauthorizedAccessException...
[2026-08-19 05:00:57.1636388 | INF]   Deferring C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl due to UnauthorizedAccessException...
[2026-08-19 05:00:57.1636388 | INF]   Deferring C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTDiagLog.etl due to UnauthorizedAccessException...
[2026-08-19 05:00:57.1636388 | INF]   Deferring C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTDiagtrack-Listener.etl due to UnauthorizedAccessException...
[2026-08-19 05:00:57.1636388 | INF]   Deferring C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTEventLog-Application.etl due to UnauthorizedAccessException...
[2026-08-19 05:00:57.1804357 | INF]   Deferring C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTEventLog-Microsoft-Windows-Sysmon-Operational.etl due to UnauthorizedAccessException...
[2026-08-19 05:00:57.1804357 | INF]   Deferring C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTEventlog-Security.etl due to UnauthorizedAccessException...
[2026-08-19 05:00:57.1804357 | INF]   Deferring C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTEventLog-System.etl due to UnauthorizedAccessException...
[2026-08-19 05:00:57.1804357 | INF]   Deferring C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTMpWppUpdateLogging.etl due to UnauthorizedAccessException...
[2026-08-19 05:00:57.1948565 | INF]   Deferring C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTSYSMON TRACE.etl due to UnauthorizedAccessException...
[2026-08-19 05:00:57.1948565 | INF]   Deferring C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTSysmonDnsEtwSession.etl due to UnauthorizedAccessException...
[2026-08-19 05:00:57.1948565 | INF]   Deferring C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTUBPM.etl due to UnauthorizedAccessException...
[2026-08-19 05:00:57.1948565 | INF]   Deferring C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTWFP-IPsec Diagnostics.etl due to UnauthorizedAccessException...
[2026-08-19 05:00:57.8853910 | INF]   Deferring C:\Windows\System32\SleepStudy\UserNotPresentSession.etl due to IOException...
[2026-08-19 05:00:58.5117121 | INF]   Deferring C:\Windows\System32\SleepStudy\ScreenOn\ScreenOnPowerStudyTraceSession-2026-08-17-20-41-11.etl due to IOException...
[2026-08-19 05:00:59.5118829 | INF]   Deferring C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\Logs\dosvc.20260818_014119_159.etl due to IOException...
[2026-08-19 05:00:59.7108876 | INF]   Deferring C:\Windows\System32\wbem\Repository\INDEX.BTR due to IOException...
[2026-08-19 05:00:59.7258088 | INF]   Deferring C:\Windows\System32\wbem\Repository\MAPPING1.MAP due to IOException...
[2026-08-19 05:00:59.7258088 | INF]   Deferring C:\Windows\System32\wbem\Repository\MAPPING2.MAP due to IOException...
[2026-08-19 05:00:59.7258088 | INF]   Deferring C:\Windows\System32\wbem\Repository\MAPPING3.MAP due to IOException...
[2026-08-19 05:00:59.7258088 | INF]   Deferring C:\Windows\System32\wbem\Repository\OBJECTS.DATA due to IOException...
[2026-08-19 05:01:00.1566872 | INF]   Deferring C:\Users\sgonk\AppData\Local\Microsoft\Edge\User Data\Default\Favicons due to IOException...
[2026-08-19 05:01:00.1590829 | INF]   Deferring C:\Users\sgonk\AppData\Local\Microsoft\Edge\User Data\Default\Favicons-journal due to IOException...
[2026-08-19 05:01:00.2535111 | INF]   Deferring C:\Users\sgonk\AppData\Local\Microsoft\Edge\User Data\Default\History due to IOException...
[2026-08-19 05:01:00.2535111 | INF]   Deferring C:\Users\sgonk\AppData\Local\Microsoft\Edge\User Data\Default\History-journal due to IOException...
[2026-08-19 05:01:00.3784896 | INF]   Deferring C:\Users\sgonk\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13431600411059163 due to IOException...
[2026-08-19 05:01:00.3941820 | INF]   Deferring C:\Users\sgonk\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13431600411153160 due to IOException...
[2026-08-19 05:01:00.3941820 | INF]   Deferring C:\Users\sgonk\AppData\Local\Microsoft\Edge\User Data\Default\Login Data due to IOException...
[2026-08-19 05:01:00.4838796 | INF]   Deferring C:\Users\sgonk\AppData\Local\Microsoft\Edge\User Data\Default\Network Action Predictor due to IOException...
[2026-08-19 05:01:00.5423099 | INF]   Deferring C:\Users\sgonk\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts due to IOException...
[2026-08-19 05:01:00.5423099 | INF]   Deferring C:\Users\sgonk\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts-journal due to IOException...
[2026-08-19 05:01:00.5423099 | INF]   Deferring C:\Users\sgonk\AppData\Local\Microsoft\Edge\User Data\Default\Top Sites due to IOException...
[2026-08-19 05:01:00.5870619 | INF]   Deferring C:\Users\sgonk\AppData\Local\Microsoft\Edge\User Data\Default\Web Data due to IOException...
[2026-08-19 05:01:00.5870619 | INF]   Deferring C:\Users\sgonk\AppData\Local\Microsoft\Edge\User Data\Default\Web Data-journal due to IOException...
[2026-08-19 05:01:00.9337381 | INF]   Deferring C:\Users\sgonk\AppData\Local\Microsoft\Internet Explorer\CacheStorage\edb.log due to IOException...
[2026-08-19 05:01:04.2077556 | INF]   Deferring C:\Users\sgonk\AppData\Local\Microsoft\Windows\WebCache\V01.log due to IOException...
[2026-08-19 05:01:04.6215487 | INF]   Deferring C:\Users\sgonk\AppData\Local\Microsoft\Windows\WebCache\V01tmp.log due to IOException...
[2026-08-19 05:01:04.6215487 | INF]   Deferring C:\Users\sgonk\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat due to IOException...
[2026-08-19 05:01:04.6215487 | INF]   Deferring C:\Users\sgonk\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.jfm due to IOException...
[2026-08-19 05:01:05.6231731 | INF]   Deferring C:\Users\sgonk\AppData\Local\ConnectedDevicesPlatform\L.sgonk\ActivitiesCache.db due to IOException...
[2026-08-19 05:01:05.6388967 | INF]   Deferring C:\Users\sgonk\AppData\Local\ConnectedDevicesPlatform\L.sgonk\ActivitiesCache.db-shm due to IOException...
[2026-08-19 05:01:05.6388967 | INF]   Deferring C:\Users\sgonk\AppData\Local\ConnectedDevicesPlatform\L.sgonk\ActivitiesCache.db-wal due to IOException...
[2026-08-19 05:01:05.6890164 | INF] Deferred file count: 290. Copying locked files...
[2026-08-19 05:01:06.0080951 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\Application.evtx to C:\kape_out\C\Windows\System32\winevt\logs\Application.evtx. Hashing source file...
[2026-08-19 05:01:06.1644867 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\Microsoft-Client-License-ESU%4Admin.evtx to C:\kape_out\C\Windows\System32\winevt\logs\Microsoft-Client-License-ESU%4Admin.evtx. Hashing source file...
[2026-08-19 05:01:06.4245168 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\Microsoft-Client-Licensing-Platform%4Admin.evtx to C:\kape_out\C\Windows\System32\winevt\logs\Microsoft-Client-Licensing-Platform%4Admin.evtx. Hashing source file...
[2026-08-19 05:01:06.6080353 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\Microsoft-Windows-AAD%4Operational.evtx to C:\kape_out\C\Windows\System32\winevt\logs\Microsoft-Windows-AAD%4Operational.evtx. Hashing source file...
[2026-08-19 05:01:06.7018680 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx to C:\kape_out\C\Windows\System32\winevt\logs\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx. Hashing source file...
[2026-08-19 05:01:07.0114475 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\Microsoft-Windows-AppModel-Runtime%4Admin.evtx to C:\kape_out\C\Windows\System32\winevt\logs\Microsoft-Windows-AppModel-Runtime%4Admin.evtx. Hashing source file...
[2026-08-19 05:01:07.2615538 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\Microsoft-Windows-AppReadiness%4Admin.evtx to C:\kape_out\C\Windows\System32\winevt\logs\Microsoft-Windows-AppReadiness%4Admin.evtx. Hashing source file...
[2026-08-19 05:01:07.2928193 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\Microsoft-Windows-AppReadiness%4Operational.evtx to C:\kape_out\C\Windows\System32\winevt\logs\Microsoft-Windows-AppReadiness%4Operational.evtx. Hashing source file...
[2026-08-19 05:01:07.7963768 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\Microsoft-Windows-AppXDeployment%4Operational.evtx to C:\kape_out\C\Windows\System32\winevt\logs\Microsoft-Windows-AppXDeployment%4Operational.evtx. Hashing source file...
[2026-08-19 05:01:07.8742437 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\Microsoft-Windows-AppXDeployment-Server%4Operational.evtx to C:\kape_out\C\Windows\System32\winevt\logs\Microsoft-Windows-AppXDeployment-Server%4Operational.evtx. Hashing source file...
[2026-08-19 05:01:08.9079010 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx to C:\kape_out\C\Windows\System32\winevt\logs\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx. Hashing source file...
[2026-08-19 05:01:09.4276855 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\Microsoft-Windows-AppxPackaging%4Operational.evtx to C:\kape_out\C\Windows\System32\winevt\logs\Microsoft-Windows-AppxPackaging%4Operational.evtx. Hashing source file...
[2026-08-19 05:01:09.4904719 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx to C:\kape_out\C\Windows\System32\winevt\logs\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx. Hashing source file...
[2026-08-19 05:01:09.5531078 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\Microsoft-Windows-Biometrics%4Operational.evtx to C:\kape_out\C\Windows\System32\winevt\logs\Microsoft-Windows-Biometrics%4Operational.evtx. Hashing source file...
[2026-08-19 05:01:09.6251610 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\Microsoft-Windows-BitLocker%4BitLocker Management.evtx to C:\kape_out\C\Windows\System32\winevt\logs\Microsoft-Windows-BitLocker%4BitLocker Management.evtx. Hashing source file...
[2026-08-19 05:01:09.8750780 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\Microsoft-Windows-Bits-Client%4Operational.evtx to C:\kape_out\C\Windows\System32\winevt\logs\Microsoft-Windows-Bits-Client%4Operational.evtx. Hashing source file...
[2026-08-19 05:01:09.9237556 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\Microsoft-Windows-CloudRestoreLauncher%4Operational.evtx to C:\kape_out\C\Windows\System32\winevt\logs\Microsoft-Windows-CloudRestoreLauncher%4Operational.evtx. Hashing source file...
[2026-08-19 05:01:10.0023004 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\Microsoft-Windows-CloudStore%4Initialization.evtx to C:\kape_out\C\Windows\System32\winevt\logs\Microsoft-Windows-CloudStore%4Initialization.evtx. Hashing source file...
[2026-08-19 05:01:10.0368420 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\Microsoft-Windows-CloudStore%4Operational.evtx to C:\kape_out\C\Windows\System32\winevt\logs\Microsoft-Windows-CloudStore%4Operational.evtx. Hashing source file...
[2026-08-19 05:01:10.1307988 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\Microsoft-Windows-CodeIntegrity%4Operational.evtx to C:\kape_out\C\Windows\System32\winevt\logs\Microsoft-Windows-CodeIntegrity%4Operational.evtx. Hashing source file...
[2026-08-19 05:01:10.2248567 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\Microsoft-Windows-Containers-BindFlt%4Operational.evtx to C:\kape_out\C\Windows\System32\winevt\logs\Microsoft-Windows-Containers-BindFlt%4Operational.evtx. Hashing source file...
[2026-08-19 05:01:10.3026063 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\Microsoft-Windows-Containers-Wcifs%4Operational.evtx to C:\kape_out\C\Windows\System32\winevt\logs\Microsoft-Windows-Containers-Wcifs%4Operational.evtx. Hashing source file...
[2026-08-19 05:01:10.5230374 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx to C:\kape_out\C\Windows\System32\winevt\logs\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx. Hashing source file...
[2026-08-19 05:01:10.6478666 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\Microsoft-Windows-Crypto-NCrypt%4Operational.evtx to C:\kape_out\C\Windows\System32\winevt\logs\Microsoft-Windows-Crypto-NCrypt%4Operational.evtx. Hashing source file...
[2026-08-19 05:01:10.7262242 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx to C:\kape_out\C\Windows\System32\winevt\logs\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx. Hashing source file...
[2026-08-19 05:01:10.8337766 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Enrollment.evtx to C:\kape_out\C\Windows\System32\winevt\logs\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Enrollment.evtx. Hashing source file...
[2026-08-19 05:01:10.8963492 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Operational.evtx to C:\kape_out\C\Windows\System32\winevt\logs\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Operational.evtx. Hashing source file...
[2026-08-19 05:01:10.9541992 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Sync.evtx to C:\kape_out\C\Windows\System32\winevt\logs\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Sync.evtx. Hashing source file...
[2026-08-19 05:01:11.0479836 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\Microsoft-Windows-DeviceSetupManager%4Operational.evtx to C:\kape_out\C\Windows\System32\winevt\logs\Microsoft-Windows-DeviceSetupManager%4Operational.evtx. Hashing source file...
[2026-08-19 05:01:11.1571688 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\Microsoft-Windows-Dhcp-Client%4Admin.evtx to C:\kape_out\C\Windows\System32\winevt\logs\Microsoft-Windows-Dhcp-Client%4Admin.evtx. Hashing source file...
[2026-08-19 05:01:11.2508555 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx to C:\kape_out\C\Windows\System32\winevt\logs\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx. Hashing source file...
[2026-08-19 05:01:11.2822947 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\Microsoft-Windows-Diagnosis-Scheduled%4Operational.evtx to C:\kape_out\C\Windows\System32\winevt\logs\Microsoft-Windows-Diagnosis-Scheduled%4Operational.evtx. Hashing source file...
[2026-08-19 05:01:11.3254620 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\Microsoft-Windows-Diagnosis-Scripted%4Admin.evtx to C:\kape_out\C\Windows\System32\winevt\logs\Microsoft-Windows-Diagnosis-Scripted%4Admin.evtx. Hashing source file...
[2026-08-19 05:01:11.4190666 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\Microsoft-Windows-Diagnosis-Scripted%4Operational.evtx to C:\kape_out\C\Windows\System32\winevt\logs\Microsoft-Windows-Diagnosis-Scripted%4Operational.evtx. Hashing source file...
[2026-08-19 05:01:11.5515124 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx to C:\kape_out\C\Windows\System32\winevt\logs\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx. Hashing source file...
[2026-08-19 05:01:11.5811570 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\Microsoft-Windows-FileHistory-Core%4WHC.evtx to C:\kape_out\C\Windows\System32\winevt\logs\Microsoft-Windows-FileHistory-Core%4WHC.evtx. Hashing source file...
[2026-08-19 05:01:12.9625955 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\Microsoft-Windows-GroupPolicy%4Operational.evtx to C:\kape_out\C\Windows\System32\winevt\logs\Microsoft-Windows-GroupPolicy%4Operational.evtx. Hashing source file...
[2026-08-19 05:01:12.9939548 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\Microsoft-Windows-HelloForBusiness%4Operational.evtx to C:\kape_out\C\Windows\System32\winevt\logs\Microsoft-Windows-HelloForBusiness%4Operational.evtx. Hashing source file...
[2026-08-19 05:01:13.3064516 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\Microsoft-Windows-Kernel-Boot%4Operational.evtx to C:\kape_out\C\Windows\System32\winevt\logs\Microsoft-Windows-Kernel-Boot%4Operational.evtx. Hashing source file...
[2026-08-19 05:01:13.4018228 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx to C:\kape_out\C\Windows\System32\winevt\logs\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx. Hashing source file...
[2026-08-19 05:01:13.4632183 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx to C:\kape_out\C\Windows\System32\winevt\logs\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx. Hashing source file...
[2026-08-19 05:01:13.5850036 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx to C:\kape_out\C\Windows\System32\winevt\logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx. Hashing source file...
[2026-08-19 05:01:13.8175043 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\Microsoft-Windows-Kernel-WHEA%4Operational.evtx to C:\kape_out\C\Windows\System32\winevt\logs\Microsoft-Windows-Kernel-WHEA%4Operational.evtx. Hashing source file...
[2026-08-19 05:01:13.8982712 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\Microsoft-Windows-Known Folders API Service.evtx to C:\kape_out\C\Windows\System32\winevt\logs\Microsoft-Windows-Known Folders API Service.evtx. Hashing source file...
[2026-08-19 05:01:13.9768627 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\Microsoft-Windows-LanguagePackSetup%4Operational.evtx to C:\kape_out\C\Windows\System32\winevt\logs\Microsoft-Windows-LanguagePackSetup%4Operational.evtx. Hashing source file...
[2026-08-19 05:01:14.0704423 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\Microsoft-Windows-LAPS%4Operational.evtx to C:\kape_out\C\Windows\System32\winevt\logs\Microsoft-Windows-LAPS%4Operational.evtx. Hashing source file...
[2026-08-19 05:01:14.9137321 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\Microsoft-Windows-LiveId%4Operational.evtx to C:\kape_out\C\Windows\System32\winevt\logs\Microsoft-Windows-LiveId%4Operational.evtx. Hashing source file...
[2026-08-19 05:01:14.9967295 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\Microsoft-Windows-NCSI%4Operational.evtx to C:\kape_out\C\Windows\System32\winevt\logs\Microsoft-Windows-NCSI%4Operational.evtx. Hashing source file...
[2026-08-19 05:01:15.0589713 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\Microsoft-Windows-NetworkProfile%4Operational.evtx to C:\kape_out\C\Windows\System32\winevt\logs\Microsoft-Windows-NetworkProfile%4Operational.evtx. Hashing source file...
[2026-08-19 05:01:15.1372257 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\Microsoft-Windows-Ntfs%4Operational.evtx to C:\kape_out\C\Windows\System32\winevt\logs\Microsoft-Windows-Ntfs%4Operational.evtx. Hashing source file...
[2026-08-19 05:01:15.1839192 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\Microsoft-Windows-Ntfs%4WHC.evtx to C:\kape_out\C\Windows\System32\winevt\logs\Microsoft-Windows-Ntfs%4WHC.evtx. Hashing source file...
[2026-08-19 05:01:15.2468247 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\Microsoft-Windows-Partition%4Diagnostic.evtx to C:\kape_out\C\Windows\System32\winevt\logs\Microsoft-Windows-Partition%4Diagnostic.evtx. Hashing source file...
[2026-08-19 05:01:15.3246938 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\Microsoft-Windows-PowerShell%4Admin.evtx to C:\kape_out\C\Windows\System32\winevt\logs\Microsoft-Windows-PowerShell%4Admin.evtx. Hashing source file...
[2026-08-19 05:01:15.5123508 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\Microsoft-Windows-PowerShell%4Operational.evtx to C:\kape_out\C\Windows\System32\winevt\logs\Microsoft-Windows-PowerShell%4Operational.evtx. Hashing source file...
[2026-08-19 05:01:15.5869620 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\Microsoft-Windows-Privacy-Auditing%4Operational.evtx to C:\kape_out\C\Windows\System32\winevt\logs\Microsoft-Windows-Privacy-Auditing%4Operational.evtx. Hashing source file...
[2026-08-19 05:01:15.7055842 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\Microsoft-Windows-Provisioning-Diagnostics-Provider%4Admin.evtx to C:\kape_out\C\Windows\System32\winevt\logs\Microsoft-Windows-Provisioning-Diagnostics-Provider%4Admin.evtx. Hashing source file...
[2026-08-19 05:01:16.7137190 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\Microsoft-Windows-PushNotification-Platform%4Operational.evtx to C:\kape_out\C\Windows\System32\winevt\logs\Microsoft-Windows-PushNotification-Platform%4Operational.evtx. Hashing source file...
[2026-08-19 05:01:16.7811383 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\Microsoft-Windows-ReadyBoost%4Operational.evtx to C:\kape_out\C\Windows\System32\winevt\logs\Microsoft-Windows-ReadyBoost%4Operational.evtx. Hashing source file...
[2026-08-19 05:01:16.9686407 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\Microsoft-Windows-RemoteAssistance%4Operational.evtx to C:\kape_out\C\Windows\System32\winevt\logs\Microsoft-Windows-RemoteAssistance%4Operational.evtx. Hashing source file...
[2026-08-19 05:01:16.9915725 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx to C:\kape_out\C\Windows\System32\winevt\logs\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx. Hashing source file...
[2026-08-19 05:01:17.0230271 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\Microsoft-Windows-Resource-Exhaustion-Resolver%4Operational.evtx to C:\kape_out\C\Windows\System32\winevt\logs\Microsoft-Windows-Resource-Exhaustion-Resolver%4Operational.evtx. Hashing source file...
[2026-08-19 05:01:17.1011524 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\Microsoft-Windows-RestartManager%4Operational.evtx to C:\kape_out\C\Windows\System32\winevt\logs\Microsoft-Windows-RestartManager%4Operational.evtx. Hashing source file...
[2026-08-19 05:01:17.1795706 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\Microsoft-Windows-Security-LessPrivilegedAppContainer%4Operational.evtx to C:\kape_out\C\Windows\System32\winevt\logs\Microsoft-Windows-Security-LessPrivilegedAppContainer%4Operational.evtx. Hashing source file...
[2026-08-19 05:01:17.3043543 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\Microsoft-Windows-Security-Mitigations%4KernelMode.evtx to C:\kape_out\C\Windows\System32\winevt\logs\Microsoft-Windows-Security-Mitigations%4KernelMode.evtx. Hashing source file...
[2026-08-19 05:01:17.4139769 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\Microsoft-Windows-Security-SPP-UX-Notifications%4ActionCenter.evtx to C:\kape_out\C\Windows\System32\winevt\logs\Microsoft-Windows-Security-SPP-UX-Notifications%4ActionCenter.evtx. Hashing source file...
[2026-08-19 05:01:17.5608294 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\Microsoft-Windows-SettingSync%4Debug.evtx to C:\kape_out\C\Windows\System32\winevt\logs\Microsoft-Windows-SettingSync%4Debug.evtx. Hashing source file...
[2026-08-19 05:01:17.6365290 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\Microsoft-Windows-SettingSync%4Operational.evtx to C:\kape_out\C\Windows\System32\winevt\logs\Microsoft-Windows-SettingSync%4Operational.evtx. Hashing source file...
[2026-08-19 05:01:17.6991955 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\Microsoft-Windows-Shell-ConnectedAccountState%4ActionCenter.evtx to C:\kape_out\C\Windows\System32\winevt\logs\Microsoft-Windows-Shell-ConnectedAccountState%4ActionCenter.evtx. Hashing source file...
[2026-08-19 05:01:17.9940930 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\Microsoft-Windows-Shell-Core%4AppDefaults.evtx to C:\kape_out\C\Windows\System32\winevt\logs\Microsoft-Windows-Shell-Core%4AppDefaults.evtx. Hashing source file...
[2026-08-19 05:01:18.3396430 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\Microsoft-Windows-Shell-Core%4Operational.evtx to C:\kape_out\C\Windows\System32\winevt\logs\Microsoft-Windows-Shell-Core%4Operational.evtx. Hashing source file...
[2026-08-19 05:01:18.4524189 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\Microsoft-Windows-ShellCommon-StartLayoutPopulation%4Operational.evtx to C:\kape_out\C\Windows\System32\winevt\logs\Microsoft-Windows-ShellCommon-StartLayoutPopulation%4Operational.evtx. Hashing source file...
[2026-08-19 05:01:18.7321454 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\Microsoft-Windows-SmbClient%4Connectivity.evtx to C:\kape_out\C\Windows\System32\winevt\logs\Microsoft-Windows-SmbClient%4Connectivity.evtx. Hashing source file...
[2026-08-19 05:01:18.9942981 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\Microsoft-Windows-SmbClient%4Security.evtx to C:\kape_out\C\Windows\System32\winevt\logs\Microsoft-Windows-SmbClient%4Security.evtx. Hashing source file...
[2026-08-19 05:01:19.0883960 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\Microsoft-Windows-SMBServer%4Operational.evtx to C:\kape_out\C\Windows\System32\winevt\logs\Microsoft-Windows-SMBServer%4Operational.evtx. Hashing source file...
[2026-08-19 05:01:19.2734536 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\Microsoft-Windows-StateRepository%4Operational.evtx to C:\kape_out\C\Windows\System32\winevt\logs\Microsoft-Windows-StateRepository%4Operational.evtx. Hashing source file...
[2026-08-19 05:01:19.5071693 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\Microsoft-Windows-Storage-Storport%4Health.evtx to C:\kape_out\C\Windows\System32\winevt\logs\Microsoft-Windows-Storage-Storport%4Health.evtx. Hashing source file...
[2026-08-19 05:01:19.7325708 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\Microsoft-Windows-Storage-Storport%4Operational.evtx to C:\kape_out\C\Windows\System32\winevt\logs\Microsoft-Windows-Storage-Storport%4Operational.evtx. Hashing source file...
[2026-08-19 05:01:19.8736807 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\Microsoft-Windows-StorageSpaces-Driver%4Operational.evtx to C:\kape_out\C\Windows\System32\winevt\logs\Microsoft-Windows-StorageSpaces-Driver%4Operational.evtx. Hashing source file...
[2026-08-19 05:01:19.9278676 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\Microsoft-Windows-StorageSpaces-ManagementAgent%4WHC.evtx to C:\kape_out\C\Windows\System32\winevt\logs\Microsoft-Windows-StorageSpaces-ManagementAgent%4WHC.evtx. Hashing source file...
[2026-08-19 05:01:23.0629916 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\Microsoft-Windows-Store%4Operational.evtx to C:\kape_out\C\Windows\System32\winevt\logs\Microsoft-Windows-Store%4Operational.evtx. Hashing source file...
[2026-08-19 05:01:23.1253201 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\Microsoft-Windows-Storsvc%4Diagnostic.evtx to C:\kape_out\C\Windows\System32\winevt\logs\Microsoft-Windows-Storsvc%4Diagnostic.evtx. Hashing source file...
[2026-08-19 05:01:34.7185074 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\Microsoft-Windows-Sysmon%4Operational.evtx to C:\kape_out\C\Windows\System32\winevt\logs\Microsoft-Windows-Sysmon%4Operational.evtx. Hashing source file...
[2026-08-19 05:01:34.8439579 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\Microsoft-Windows-TaskScheduler%4Maintenance.evtx to C:\kape_out\C\Windows\System32\winevt\logs\Microsoft-Windows-TaskScheduler%4Maintenance.evtx. Hashing source file...
[2026-08-19 05:01:36.6686092 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\Microsoft-Windows-TaskScheduler%4Operational.evtx to C:\kape_out\C\Windows\System32\winevt\logs\Microsoft-Windows-TaskScheduler%4Operational.evtx. Hashing source file...
[2026-08-19 05:01:36.7335357 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx to C:\kape_out\C\Windows\System32\winevt\logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx. Hashing source file...
[2026-08-19 05:01:36.7812542 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx to C:\kape_out\C\Windows\System32\winevt\logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx. Hashing source file...
[2026-08-19 05:01:36.8899767 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\Microsoft-Windows-Time-Service%4Operational.evtx to C:\kape_out\C\Windows\System32\winevt\logs\Microsoft-Windows-Time-Service%4Operational.evtx. Hashing source file...
[2026-08-19 05:01:36.9995982 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\Microsoft-Windows-TZSync%4Operational.evtx to C:\kape_out\C\Windows\System32\winevt\logs\Microsoft-Windows-TZSync%4Operational.evtx. Hashing source file...
[2026-08-19 05:01:37.3745712 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\Microsoft-Windows-UniversalTelemetryClient%4Operational.evtx to C:\kape_out\C\Windows\System32\winevt\logs\Microsoft-Windows-UniversalTelemetryClient%4Operational.evtx. Hashing source file...
[2026-08-19 05:01:37.4937445 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\Microsoft-Windows-User Device Registration%4Admin.evtx to C:\kape_out\C\Windows\System32\winevt\logs\Microsoft-Windows-User Device Registration%4Admin.evtx. Hashing source file...
[2026-08-19 05:01:37.5557791 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\Microsoft-Windows-User Profile Service%4Operational.evtx to C:\kape_out\C\Windows\System32\winevt\logs\Microsoft-Windows-User Profile Service%4Operational.evtx. Hashing source file...
[2026-08-19 05:01:37.7169531 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx to C:\kape_out\C\Windows\System32\winevt\logs\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx. Hashing source file...
[2026-08-19 05:01:37.7991254 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\Microsoft-Windows-Wcmsvc%4Operational.evtx to C:\kape_out\C\Windows\System32\winevt\logs\Microsoft-Windows-Wcmsvc%4Operational.evtx. Hashing source file...
[2026-08-19 05:01:37.8457998 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\Microsoft-Windows-WebAuthN%4Operational.evtx to C:\kape_out\C\Windows\System32\winevt\logs\Microsoft-Windows-WebAuthN%4Operational.evtx. Hashing source file...
[2026-08-19 05:01:37.9082440 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\Microsoft-Windows-WER-PayloadHealth%4Operational.evtx to C:\kape_out\C\Windows\System32\winevt\logs\Microsoft-Windows-WER-PayloadHealth%4Operational.evtx. Hashing source file...
[2026-08-19 05:01:38.0809108 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\Microsoft-Windows-Windows Defender%4Operational.evtx to C:\kape_out\C\Windows\System32\winevt\logs\Microsoft-Windows-Windows Defender%4Operational.evtx. Hashing source file...
[2026-08-19 05:01:38.6000041 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx to C:\kape_out\C\Windows\System32\winevt\logs\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx. Hashing source file...
[2026-08-19 05:01:38.6709435 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\Microsoft-Windows-Windows Firewall With Advanced Security%4FirewallDiagnostics.evtx to C:\kape_out\C\Windows\System32\winevt\logs\Microsoft-Windows-Windows Firewall With Advanced Security%4FirewallDiagnostics.evtx. Hashing source file...
[2026-08-19 05:01:38.7955630 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\Microsoft-Windows-WindowsBackup%4ActionCenter.evtx to C:\kape_out\C\Windows\System32\winevt\logs\Microsoft-Windows-WindowsBackup%4ActionCenter.evtx. Hashing source file...
[2026-08-19 05:01:38.9053009 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\Microsoft-Windows-WindowsSystemAssessmentTool%4Operational.evtx to C:\kape_out\C\Windows\System32\winevt\logs\Microsoft-Windows-WindowsSystemAssessmentTool%4Operational.evtx. Hashing source file...
[2026-08-19 05:01:39.0516136 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\Microsoft-Windows-WindowsUpdateClient%4Operational.evtx to C:\kape_out\C\Windows\System32\winevt\logs\Microsoft-Windows-WindowsUpdateClient%4Operational.evtx. Hashing source file...
[2026-08-19 05:01:39.0984522 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx to C:\kape_out\C\Windows\System32\winevt\logs\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx. Hashing source file...
[2026-08-19 05:01:39.2417177 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\Microsoft-Windows-Winlogon%4Operational.evtx to C:\kape_out\C\Windows\System32\winevt\logs\Microsoft-Windows-Winlogon%4Operational.evtx. Hashing source file...
[2026-08-19 05:01:39.2885181 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\Microsoft-Windows-WinRM%4Operational.evtx to C:\kape_out\C\Windows\System32\winevt\logs\Microsoft-Windows-WinRM%4Operational.evtx. Hashing source file...
[2026-08-19 05:01:39.5696727 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\Microsoft-Windows-WMI-Activity%4Operational.evtx to C:\kape_out\C\Windows\System32\winevt\logs\Microsoft-Windows-WMI-Activity%4Operational.evtx. Hashing source file...
[2026-08-19 05:01:39.7026976 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\Parameters.evtx to C:\kape_out\C\Windows\System32\winevt\logs\Parameters.evtx. Hashing source file...
[2026-08-19 05:01:43.2273490 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\Security.evtx to C:\kape_out\C\Windows\System32\winevt\logs\Security.evtx. Hashing source file...
[2026-08-19 05:01:43.2744056 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\Setup.evtx to C:\kape_out\C\Windows\System32\winevt\logs\Setup.evtx. Hashing source file...
[2026-08-19 05:01:43.3369418 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\State.evtx to C:\kape_out\C\Windows\System32\winevt\logs\State.evtx. Hashing source file...
[2026-08-19 05:01:43.7372390 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\System.evtx to C:\kape_out\C\Windows\System32\winevt\logs\System.evtx. Hashing source file...
[2026-08-19 05:01:43.8978092 | INF]   Copied deferred file C:\Windows\System32\winevt\logs\Windows PowerShell.evtx to C:\kape_out\C\Windows\System32\winevt\logs\Windows PowerShell.evtx. Hashing source file...
[2026-08-19 05:01:44.7226762 | INF]   Copied deferred file C:\Windows\AppCompat\Programs\Amcache.hve to C:\kape_out\C\Windows\AppCompat\Programs\Amcache.hve. Hashing source file...
[2026-08-19 05:01:45.0591882 | INF]   Copied deferred file C:\Windows\AppCompat\Programs\Amcache.hve.LOG1 to C:\kape_out\C\Windows\AppCompat\Programs\Amcache.hve.LOG1. Hashing source file...
[2026-08-19 05:01:45.3872654 | INF]   Copied deferred file C:\Windows\AppCompat\Programs\Amcache.hve.LOG2 to C:\kape_out\C\Windows\AppCompat\Programs\Amcache.hve.LOG2. Hashing source file...
[2026-08-19 05:03:49.3088253 | INF]   Copied deferred file C:\$MFT to C:\kape_out\C\$MFT. Hashing source file...
[2026-08-19 05:03:55.9521264 | INF]   Copied deferred file C:\$LogFile to C:\kape_out\C\$LogFile. Hashing source file...
[2026-08-19 05:03:56.4599010 | WRN]   Skipping sparse data area in $J!
[2026-08-19 05:04:08.2352097 | INF]   Copied deferred file C:\$Extend\$UsnJrnl:$J to C:\kape_out\C\$Extend\$J. Hashing source file...
[2026-08-19 05:04:08.2352097 | INF]   Copied deferred file C:\$Extend\$UsnJrnl:$Max to C:\kape_out\C\$Extend\$Max. Hashing source file...
[2026-08-19 05:04:08.5305011 | INF]   Copied deferred file C:\$Secure:$SDS to C:\kape_out\C\$Secure_$SDS. Hashing source file...
[2026-08-19 05:04:08.5462294 | INF]   Copied deferred file C:\$Boot to C:\kape_out\C\$Boot. Hashing source file...
[2026-08-19 05:04:08.6561843 | INF]   Copied deferred file C:\$Extend\$RmMetadata\$TxfLog\$Tops:$T to C:\kape_out\C\$Extend\$RmMetadata\$TxfLog\$T. Hashing source file...
[2026-08-19 05:04:08.7032284 | INF]   Copied deferred file C:\Windows\System32\config\SAM.LOG1 to C:\kape_out\C\Windows\System32\config\SAM.LOG1. Hashing source file...
[2026-08-19 05:04:08.7187305 | INF]   Copied deferred file C:\Windows\System32\config\SAM.LOG2 to C:\kape_out\C\Windows\System32\config\SAM.LOG2. Hashing source file...
[2026-08-19 05:04:08.7450694 | INF]   Copied deferred file C:\Windows\System32\config\SECURITY.LOG1 to C:\kape_out\C\Windows\System32\config\SECURITY.LOG1. Hashing source file...
[2026-08-19 05:04:08.7766611 | INF]   Copied deferred file C:\Windows\System32\config\SECURITY.LOG2 to C:\kape_out\C\Windows\System32\config\SECURITY.LOG2. Hashing source file...
[2026-08-19 05:04:10.4876233 | INF]   Copied deferred file C:\Windows\System32\config\SOFTWARE.LOG1 to C:\kape_out\C\Windows\System32\config\SOFTWARE.LOG1. Hashing source file...
[2026-08-19 05:04:12.3355103 | INF]   Copied deferred file C:\Windows\System32\config\SOFTWARE.LOG2 to C:\kape_out\C\Windows\System32\config\SOFTWARE.LOG2. Hashing source file...
[2026-08-19 05:04:12.7957098 | INF]   Copied deferred file C:\Windows\System32\config\SYSTEM.LOG1 to C:\kape_out\C\Windows\System32\config\SYSTEM.LOG1. Hashing source file...
[2026-08-19 05:04:13.0144414 | INF]   Copied deferred file C:\Windows\System32\config\SYSTEM.LOG2 to C:\kape_out\C\Windows\System32\config\SYSTEM.LOG2. Hashing source file...
[2026-08-19 05:04:13.0304391 | INF]   Copied deferred file C:\Windows\System32\config\SAM to C:\kape_out\C\Windows\System32\config\SAM. Hashing source file...
[2026-08-19 05:04:13.0458884 | INF]   Copied deferred file C:\Windows\System32\config\SECURITY to C:\kape_out\C\Windows\System32\config\SECURITY. Hashing source file...
[2026-08-19 05:04:24.5817760 | INF]   Copied deferred file C:\Windows\System32\config\SOFTWARE to C:\kape_out\C\Windows\System32\config\SOFTWARE. Hashing source file...
[2026-08-19 05:04:26.7730129 | INF]   Copied deferred file C:\Windows\System32\config\SYSTEM to C:\kape_out\C\Windows\System32\config\SYSTEM. Hashing source file...
[2026-08-19 05:04:26.9763790 | INF]   Copied deferred file C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT to C:\kape_out\C\Windows\ServiceProfiles\LocalService\NTUSER.DAT. Hashing source file...
[2026-08-19 05:04:27.0078079 | INF]   Copied deferred file C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT.LOG1 to C:\kape_out\C\Windows\ServiceProfiles\LocalService\NTUSER.DAT.LOG1. Hashing source file...
[2026-08-19 05:04:27.0230236 | INF]   Copied deferred file C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT.LOG2 to C:\kape_out\C\Windows\ServiceProfiles\LocalService\NTUSER.DAT.LOG2. Hashing source file...
[2026-08-19 05:04:27.3211847 | INF]   Copied deferred file C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT to C:\kape_out\C\Windows\ServiceProfiles\NetworkService\NTUSER.DAT. Hashing source file...
[2026-08-19 05:04:27.3366425 | INF]   Copied deferred file C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT.LOG1 to C:\kape_out\C\Windows\ServiceProfiles\NetworkService\NTUSER.DAT.LOG1. Hashing source file...
[2026-08-19 05:04:27.4618767 | INF]   Copied deferred file C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT.LOG2 to C:\kape_out\C\Windows\ServiceProfiles\NetworkService\NTUSER.DAT.LOG2. Hashing source file...
[2026-08-19 05:04:27.5399838 | INF]   Copied deferred file C:\Users\jgartnet\NTUSER.DAT to C:\kape_out\C\Users\jgartnet\NTUSER.DAT. Hashing source file...
[2026-08-19 05:04:27.7349350 | INF]   Copied deferred file C:\Users\sgonk\NTUSER.DAT to C:\kape_out\C\Users\sgonk\NTUSER.DAT. Hashing source file...
[2026-08-19 05:04:27.8211893 | INF]   Copied deferred file C:\Users\jgartnet\ntuser.dat.LOG1 to C:\kape_out\C\Users\jgartnet\ntuser.dat.LOG1. Hashing source file...
[2026-08-19 05:04:27.8669496 | INF]   Copied deferred file C:\Users\jgartnet\ntuser.dat.LOG2 to C:\kape_out\C\Users\jgartnet\ntuser.dat.LOG2. Hashing source file...
[2026-08-19 05:04:27.8977993 | INF]   Copied deferred file C:\Users\sgonk\ntuser.dat.LOG1 to C:\kape_out\C\Users\sgonk\ntuser.dat.LOG1. Hashing source file...
[2026-08-19 05:04:27.9757457 | INF]   Copied deferred file C:\Users\sgonk\ntuser.dat.LOG2 to C:\kape_out\C\Users\sgonk\ntuser.dat.LOG2. Hashing source file...
[2026-08-19 05:04:28.1168263 | INF]   Copied deferred file C:\Windows\System32\config\DEFAULT to C:\kape_out\C\Windows\System32\config\DEFAULT. Hashing source file...
[2026-08-19 05:04:28.2259183 | INF]   Copied deferred file C:\Windows\System32\config\DEFAULT.LOG1 to C:\kape_out\C\Windows\System32\config\DEFAULT.LOG1. Hashing source file...
[2026-08-19 05:04:28.3215763 | INF]   Copied deferred file C:\Windows\System32\config\DEFAULT.LOG2 to C:\kape_out\C\Windows\System32\config\DEFAULT.LOG2. Hashing source file...
[2026-08-19 05:04:28.3529833 | INF]   Copied deferred file C:\Users\jgartnet\AppData\Local\Microsoft\Windows\UsrClass.dat to C:\kape_out\C\Users\jgartnet\AppData\Local\Microsoft\Windows\UsrClass.dat. Hashing source file...
[2026-08-19 05:04:30.0777985 | INF]   Copied deferred file C:\Users\sgonk\AppData\Local\Microsoft\Windows\UsrClass.dat to C:\kape_out\C\Users\sgonk\AppData\Local\Microsoft\Windows\UsrClass.dat. Hashing source file...
[2026-08-19 05:04:30.0942374 | INF]   Copied deferred file C:\Users\jgartnet\AppData\Local\Microsoft\Windows\UsrClass.dat.LOG1 to C:\kape_out\C\Users\jgartnet\AppData\Local\Microsoft\Windows\UsrClass.dat.LOG1. Hashing source file...
[2026-08-19 05:04:30.1247322 | INF]   Copied deferred file C:\Users\jgartnet\AppData\Local\Microsoft\Windows\UsrClass.dat.LOG2 to C:\kape_out\C\Users\jgartnet\AppData\Local\Microsoft\Windows\UsrClass.dat.LOG2. Hashing source file...
[2026-08-19 05:04:30.2798077 | INF]   Copied deferred file C:\Users\sgonk\AppData\Local\Microsoft\Windows\UsrClass.dat.LOG1 to C:\kape_out\C\Users\sgonk\AppData\Local\Microsoft\Windows\UsrClass.dat.LOG1. Hashing source file...
[2026-08-19 05:04:30.4205854 | INF]   Copied deferred file C:\Users\sgonk\AppData\Local\Microsoft\Windows\UsrClass.dat.LOG2 to C:\kape_out\C\Users\sgonk\AppData\Local\Microsoft\Windows\UsrClass.dat.LOG2. Hashing source file...
[2026-08-19 05:04:30.4364397 | INF]   Copied deferred file C:\Windows\System32\Tasks\Microsoft\Windows\GroupPolicy\{3E0A038B-D834-4930-9981-E89C9BFF83AA} to C:\kape_out\C\Windows\System32\Tasks\Microsoft\Windows\GroupPolicy\{3E0A038B-D834-4930-9981-E89C9BFF83AA}. Hashing source file...
[2026-08-19 05:04:30.4364397 | INF]   Copied deferred file C:\Windows\System32\Tasks\Microsoft\Windows\GroupPolicy\{A7719E0F-10DB-4640-AD8C-490CC6AD5202} to C:\kape_out\C\Windows\System32\Tasks\Microsoft\Windows\GroupPolicy\{A7719E0F-10DB-4640-AD8C-490CC6AD5202}. Hashing source file...
[2026-08-19 05:04:30.4521561 | INF]   Copied deferred file C:\Users\jgartnet\AppData\Local\Microsoft\Windows\Explorer\thumbcache_256.db to C:\kape_out\C\Users\jgartnet\AppData\Local\Microsoft\Windows\Explorer\thumbcache_256.db. Hashing source file...
[2026-08-19 05:04:30.4521561 | INF]   Copied deferred file C:\Users\jgartnet\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db to C:\kape_out\C\Users\jgartnet\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db. Hashing source file...
[2026-08-19 05:04:30.4675500 | INF]   Copied deferred file C:\Users\sgonk\AppData\Local\Microsoft\Windows\Explorer\thumbcache_16.db to C:\kape_out\C\Users\sgonk\AppData\Local\Microsoft\Windows\Explorer\thumbcache_16.db. Hashing source file...
[2026-08-19 05:04:30.4833353 | INF]   Copied deferred file C:\Users\sgonk\AppData\Local\Microsoft\Windows\Explorer\thumbcache_256.db to C:\kape_out\C\Users\sgonk\AppData\Local\Microsoft\Windows\Explorer\thumbcache_256.db. Hashing source file...
[2026-08-19 05:04:30.4833353 | INF]   Copied deferred file C:\Users\sgonk\AppData\Local\Microsoft\Windows\Explorer\thumbcache_32.db to C:\kape_out\C\Users\sgonk\AppData\Local\Microsoft\Windows\Explorer\thumbcache_32.db. Hashing source file...
[2026-08-19 05:04:30.5145298 | INF]   Copied deferred file C:\Users\sgonk\AppData\Local\Microsoft\Windows\Explorer\thumbcache_48.db to C:\kape_out\C\Users\sgonk\AppData\Local\Microsoft\Windows\Explorer\thumbcache_48.db. Hashing source file...
[2026-08-19 05:04:30.5145298 | INF]   Copied deferred file C:\Users\sgonk\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db to C:\kape_out\C\Users\sgonk\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db. Hashing source file...
[2026-08-19 05:04:30.7391972 | INF]   Copied deferred file C:\programdata\microsoft\search\data\applications\windows\edb.jtx to C:\kape_out\C\programdata\microsoft\search\data\applications\windows\edb.jtx. Hashing source file...
[2026-08-19 05:04:31.0977732 | INF]   Copied deferred file C:\programdata\microsoft\search\data\applications\windows\edbtmp.jtx to C:\kape_out\C\programdata\microsoft\search\data\applications\windows\edbtmp.jtx. Hashing source file...
[2026-08-19 05:04:32.2861368 | INF]   Copied deferred file C:\programdata\microsoft\search\data\applications\windows\Windows.edb to C:\kape_out\C\programdata\microsoft\search\data\applications\windows\Windows.edb. Hashing source file...
[2026-08-19 05:04:32.2861368 | INF]   Copied deferred file C:\programdata\microsoft\search\data\applications\windows\Windows.jfm to C:\kape_out\C\programdata\microsoft\search\data\applications\windows\Windows.jfm. Hashing source file...
[2026-08-19 05:04:32.2861368 | INF]   Copied deferred file C:\programdata\microsoft\search\data\applications\windows\GatherLogs\SystemIndex\SystemIndex.8.gthr to C:\kape_out\C\programdata\microsoft\search\data\applications\windows\GatherLogs\SystemIndex\SystemIndex.8.gthr. Hashing source file...
[2026-08-19 05:04:32.3208001 | INF]   Copied deferred file C:\ProgramData\Microsoft\Windows Defender\Support\MPDetection-20260808-150351.log to C:\kape_out\C\ProgramData\Microsoft\Windows Defender\Support\MPDetection-20260808-150351.log. Hashing source file...
[2026-08-19 05:04:32.3673661 | INF]   Copied deferred file C:\ProgramData\Microsoft\Windows Defender\Support\MPDeviceControl-20260809-015250.log to C:\kape_out\C\ProgramData\Microsoft\Windows Defender\Support\MPDeviceControl-20260809-015250.log. Hashing source file...
[2026-08-19 05:04:32.8563565 | INF]   Copied deferred file C:\ProgramData\Microsoft\Windows Defender\Support\MPLog-20260808-150351.log to C:\kape_out\C\ProgramData\Microsoft\Windows Defender\Support\MPLog-20260808-150351.log. Hashing source file...
[2026-08-19 05:04:32.8876913 | INF]   Copied deferred file C:\ProgramData\Microsoft\Windows Defender\Support\MPScanSkip-20260809-015250.log to C:\kape_out\C\ProgramData\Microsoft\Windows Defender\Support\MPScanSkip-20260809-015250.log. Hashing source file...
[2026-08-19 05:04:32.9500713 | INF]   Copied deferred file C:\ProgramData\Microsoft\Windows Defender\Support\MpWppCoreTracing-20260817-204110-00000003-100000000.bin to C:\kape_out\C\ProgramData\Microsoft\Windows Defender\Support\MpWppCoreTracing-20260817-204110-00000003-100000000.bin. Hashing source file...
[2026-08-19 05:04:33.9447355 | INF]   Copied deferred file C:\ProgramData\Microsoft\Windows Defender\Support\MpWppTracing-20260818-014111-00000003-fffffffeffffffff.bin to C:\kape_out\C\ProgramData\Microsoft\Windows Defender\Support\MpWppTracing-20260818-014111-00000003-fffffffeffffffff.bin. Hashing source file...
[2026-08-19 05:04:34.0539891 | INF]   Copied deferred file C:\ProgramData\Microsoft\Windows Defender\Support\MpWppUpdateLogging-20260817-204110.bin to C:\kape_out\C\ProgramData\Microsoft\Windows Defender\Support\MpWppUpdateLogging-20260817-204110.bin. Hashing source file...
[2026-08-19 05:04:34.0853513 | INF]   Copied deferred file C:\Users\sgonk\AppData\Local\Microsoft\OneDrive\logs\Common\FileCoAuth-2026-08-19.0943.2764.2.aodl to C:\kape_out\C\Users\sgonk\AppData\Local\Microsoft\OneDrive\logs\Common\FileCoAuth-2026-08-19.0943.2764.2.aodl. Hashing source file...
[2026-08-19 05:04:34.1010490 | INF]   Copied deferred file C:\Users\sgonk\AppData\Local\Microsoft\OneDrive\logs\Personal\SyncEngine-2026-08-19.0930.4828.4.aodl to C:\kape_out\C\Users\sgonk\AppData\Local\Microsoft\OneDrive\logs\Personal\SyncEngine-2026-08-19.0930.4828.4.aodl. Hashing source file...
[2026-08-19 05:04:34.1324154 | INF]   Copied deferred file C:\Users\sgonk\AppData\Local\Microsoft\OneDrive\logs\Personal\telemetryCache.otc to C:\kape_out\C\Users\sgonk\AppData\Local\Microsoft\OneDrive\logs\Personal\telemetryCache.otc. Hashing source file...
[2026-08-19 05:04:34.1324154 | INF]   Copied deferred file C:\Users\sgonk\AppData\Local\Microsoft\OneDrive\logs\Personal\telemetryCache.otc-shm to C:\kape_out\C\Users\sgonk\AppData\Local\Microsoft\OneDrive\logs\Personal\telemetryCache.otc-shm. Hashing source file...
[2026-08-19 05:04:34.1634354 | INF]   Copied deferred file C:\Users\sgonk\AppData\Local\Microsoft\OneDrive\logs\Personal\telemetryCache.otc-wal to C:\kape_out\C\Users\sgonk\AppData\Local\Microsoft\OneDrive\logs\Personal\telemetryCache.otc-wal. Hashing source file...
[2026-08-19 05:04:34.1951970 | INF]   Copied deferred file C:\Users\sgonk\AppData\Local\Microsoft\OneDrive\logs\ListSync\Business1\microsoftNucleusTelemetryCache.otc-shm to C:\kape_out\C\Users\sgonk\AppData\Local\Microsoft\OneDrive\logs\ListSync\Business1\microsoftNucleusTelemetryCache.otc-shm. Hashing source file...
[2026-08-19 05:04:34.2102334 | INF]   Copied deferred file C:\Users\sgonk\AppData\Local\Microsoft\OneDrive\logs\ListSync\Business1\microsoftNucleusTelemetryCache.otc-wal to C:\kape_out\C\Users\sgonk\AppData\Local\Microsoft\OneDrive\logs\ListSync\Business1\microsoftNucleusTelemetryCache.otc-wal. Hashing source file...
[2026-08-19 05:04:34.2271490 | INF]   Copied deferred file C:\Users\sgonk\AppData\Local\Microsoft\OneDrive\logs\ListSync\Business1\NucleusBusiness-2026-08-18.1001.8104.1.aodl to C:\kape_out\C\Users\sgonk\AppData\Local\Microsoft\OneDrive\logs\ListSync\Business1\NucleusBusiness-2026-08-18.1001.8104.1.aodl. Hashing source file...
[2026-08-19 05:04:34.2590895 | INF]   Copied deferred file C:\Users\sgonk\AppData\Local\Microsoft\OneDrive\logs\ListSync\Common\microsoftNucleusTelemetryCache.otc-shm to C:\kape_out\C\Users\sgonk\AppData\Local\Microsoft\OneDrive\logs\ListSync\Common\microsoftNucleusTelemetryCache.otc-shm. Hashing source file...
[2026-08-19 05:04:34.2877936 | INF]   Copied deferred file C:\Users\sgonk\AppData\Local\Microsoft\OneDrive\logs\ListSync\Common\microsoftNucleusTelemetryCache.otc-wal to C:\kape_out\C\Users\sgonk\AppData\Local\Microsoft\OneDrive\logs\ListSync\Common\microsoftNucleusTelemetryCache.otc-wal. Hashing source file...
[2026-08-19 05:04:34.3854791 | INF]   Copied deferred file C:\Users\sgonk\AppData\Local\Microsoft\OneDrive\logs\ListSync\Common\Nucleus-2026-08-19.0241.8104.3.aodl to C:\kape_out\C\Users\sgonk\AppData\Local\Microsoft\OneDrive\logs\ListSync\Common\Nucleus-2026-08-19.0241.8104.3.aodl. Hashing source file...
[2026-08-19 05:04:34.4952336 | INF]   Copied deferred file C:\Users\sgonk\AppData\Local\Microsoft\OneDrive\logs\ListSync\Local\NucleusLocal-2026-08-18.1001.8104.1.aodl to C:\kape_out\C\Users\sgonk\AppData\Local\Microsoft\OneDrive\logs\ListSync\Local\NucleusLocal-2026-08-18.1001.8104.1.aodl. Hashing source file...
[2026-08-19 05:04:34.5106678 | INF]   Copied deferred file C:\Users\sgonk\AppData\Local\Microsoft\OneDrive\logs\ListSync\UnAuthenticated\microsoftNucleusTelemetryCache.otc-shm to C:\kape_out\C\Users\sgonk\AppData\Local\Microsoft\OneDrive\logs\ListSync\UnAuthenticated\microsoftNucleusTelemetryCache.otc-shm. Hashing source file...
[2026-08-19 05:04:34.5417272 | INF]   Copied deferred file C:\Users\sgonk\AppData\Local\Microsoft\OneDrive\logs\ListSync\UnAuthenticated\microsoftNucleusTelemetryCache.otc-wal to C:\kape_out\C\Users\sgonk\AppData\Local\Microsoft\OneDrive\logs\ListSync\UnAuthenticated\microsoftNucleusTelemetryCache.otc-wal. Hashing source file...
[2026-08-19 05:04:34.5571943 | INF]   Copied deferred file C:\Users\sgonk\AppData\Local\Microsoft\OneDrive\logs\ListSync\UnAuthenticated\NucleusUnAuthenticated-2026-08-18.1001.8104.1.aodl to C:\kape_out\C\Users\sgonk\AppData\Local\Microsoft\OneDrive\logs\ListSync\UnAuthenticated\NucleusUnAuthenticated-2026-08-18.1001.8104.1.aodl. Hashing source file...
[2026-08-19 05:04:34.6234995 | INF]   Copied deferred file C:\Users\sgonk\AppData\Local\Microsoft\OneDrive\settings\Personal\CxP.db to C:\kape_out\C\Users\sgonk\AppData\Local\Microsoft\OneDrive\settings\Personal\CxP.db. Hashing source file...
[2026-08-19 05:04:34.6318828 | INF]   Copied deferred file C:\Users\sgonk\AppData\Local\Microsoft\OneDrive\settings\Personal\CxP.db-shm to C:\kape_out\C\Users\sgonk\AppData\Local\Microsoft\OneDrive\settings\Personal\CxP.db-shm. Hashing source file...
[2026-08-19 05:04:34.6486632 | INF]   Copied deferred file C:\Users\sgonk\AppData\Local\Microsoft\OneDrive\settings\Personal\CxP.db-wal to C:\kape_out\C\Users\sgonk\AppData\Local\Microsoft\OneDrive\settings\Personal\CxP.db-wal. Hashing source file...
[2026-08-19 05:04:34.6641731 | INF]   Copied deferred file C:\Users\sgonk\AppData\Local\Microsoft\OneDrive\settings\Personal\OCSI.db to C:\kape_out\C\Users\sgonk\AppData\Local\Microsoft\OneDrive\settings\Personal\OCSI.db. Hashing source file...
[2026-08-19 05:04:34.6798591 | INF]   Copied deferred file C:\Users\sgonk\AppData\Local\Microsoft\OneDrive\settings\Personal\SafeDelete.db to C:\kape_out\C\Users\sgonk\AppData\Local\Microsoft\OneDrive\settings\Personal\SafeDelete.db. Hashing source file...
[2026-08-19 05:04:34.6956747 | INF]   Copied deferred file C:\Users\sgonk\AppData\Local\Microsoft\OneDrive\settings\Personal\SettingsDatabase.db to C:\kape_out\C\Users\sgonk\AppData\Local\Microsoft\OneDrive\settings\Personal\SettingsDatabase.db. Hashing source file...
[2026-08-19 05:04:34.7112452 | INF]   Copied deferred file C:\Users\sgonk\AppData\Local\Microsoft\OneDrive\settings\Personal\SettingsDatabase.db-shm to C:\kape_out\C\Users\sgonk\AppData\Local\Microsoft\OneDrive\settings\Personal\SettingsDatabase.db-shm. Hashing source file...
[2026-08-19 05:04:34.7270513 | INF]   Copied deferred file C:\Users\sgonk\AppData\Local\Microsoft\OneDrive\settings\Personal\SettingsDatabase.db-wal to C:\kape_out\C\Users\sgonk\AppData\Local\Microsoft\OneDrive\settings\Personal\SettingsDatabase.db-wal. Hashing source file...
[2026-08-19 05:04:34.7578487 | INF]   Copied deferred file C:\Users\sgonk\AppData\Local\Microsoft\OneDrive\settings\Personal\SyncEngineDatabase.db to C:\kape_out\C\Users\sgonk\AppData\Local\Microsoft\OneDrive\settings\Personal\SyncEngineDatabase.db. Hashing source file...
[2026-08-19 05:04:34.7636578 | INF]   Copied deferred file C:\Users\sgonk\AppData\Local\Microsoft\OneDrive\settings\Personal\UXDatabase.db to C:\kape_out\C\Users\sgonk\AppData\Local\Microsoft\OneDrive\settings\Personal\UXDatabase.db. Hashing source file...
[2026-08-19 05:04:35.2963189 | INF]   Copied deferred file C:\Windows\System32\LogFiles\WMI\LwtNetLog.etl to C:\kape_out\C\Windows\System32\LogFiles\WMI\LwtNetLog.etl. Hashing source file...
[2026-08-19 05:04:35.3281409 | INF]   Copied deferred file C:\Windows\System32\LogFiles\WMI\Microsoft-Windows-Rdp-Graphics-RdpIdd-Trace.etl to C:\kape_out\C\Windows\System32\LogFiles\WMI\Microsoft-Windows-Rdp-Graphics-RdpIdd-Trace.etl. Hashing source file...
[2026-08-19 05:04:38.1513428 | INF]   Copied deferred file C:\Windows\System32\LogFiles\WMI\NetCore.etl to C:\kape_out\C\Windows\System32\LogFiles\WMI\NetCore.etl. Hashing source file...
[2026-08-19 05:04:38.1709417 | INF]   Copied deferred file C:\Windows\System32\LogFiles\WMI\NtfsLog.etl to C:\kape_out\C\Windows\System32\LogFiles\WMI\NtfsLog.etl. Hashing source file...
[2026-08-19 05:04:38.2489701 | INF]   Copied deferred file C:\Windows\System32\LogFiles\WMI\RadioMgr.etl to C:\kape_out\C\Windows\System32\LogFiles\WMI\RadioMgr.etl. Hashing source file...
[2026-08-19 05:04:38.2904865 | INF]   Copied deferred file C:\Windows\System32\LogFiles\WMI\Wifi.etl to C:\kape_out\C\Windows\System32\LogFiles\WMI\Wifi.etl. Hashing source file...
[2026-08-19 05:04:48.5883324 | INF]   Copied deferred file C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl to C:\kape_out\C\Windows\System32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl. Hashing source file...
[2026-08-19 05:04:49.1949676 | INF]   Copied deferred file C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl to C:\kape_out\C\Windows\System32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl. Hashing source file...
[2026-08-19 05:04:49.1949676 | INF]   Copied deferred file C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTDiagLog.etl to C:\kape_out\C\Windows\System32\LogFiles\WMI\RtBackup\EtwRTDiagLog.etl. Hashing source file...
[2026-08-19 05:04:49.2264625 | INF]   Copied deferred file C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTDiagtrack-Listener.etl to C:\kape_out\C\Windows\System32\LogFiles\WMI\RtBackup\EtwRTDiagtrack-Listener.etl. Hashing source file...
[2026-08-19 05:04:49.2417786 | INF]   Copied deferred file C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTEventLog-Application.etl to C:\kape_out\C\Windows\System32\LogFiles\WMI\RtBackup\EtwRTEventLog-Application.etl. Hashing source file...
[2026-08-19 05:04:49.2577658 | INF]   Copied deferred file C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTEventLog-Microsoft-Windows-Sysmon-Operational.etl to C:\kape_out\C\Windows\System32\LogFiles\WMI\RtBackup\EtwRTEventLog-Microsoft-Windows-Sysmon-Operational.etl. Hashing source file...
[2026-08-19 05:04:49.2730747 | INF]   Copied deferred file C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTEventlog-Security.etl to C:\kape_out\C\Windows\System32\LogFiles\WMI\RtBackup\EtwRTEventlog-Security.etl. Hashing source file...
[2026-08-19 05:04:49.2886328 | INF]   Copied deferred file C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTEventLog-System.etl to C:\kape_out\C\Windows\System32\LogFiles\WMI\RtBackup\EtwRTEventLog-System.etl. Hashing source file...
[2026-08-19 05:04:49.7396507 | INF]   Copied deferred file C:\Windows\System32\SleepStudy\UserNotPresentSession.etl to C:\kape_out\C\Windows\System32\SleepStudy\UserNotPresentSession.etl. Hashing source file...
[2026-08-19 05:04:49.8399099 | INF]   Copied deferred file C:\Windows\System32\SleepStudy\ScreenOn\ScreenOnPowerStudyTraceSession-2026-08-17-20-41-11.etl to C:\kape_out\C\Windows\System32\SleepStudy\ScreenOn\ScreenOnPowerStudyTraceSession-2026-08-17-20-41-11.etl. Hashing source file...
[2026-08-19 05:04:50.7307347 | INF]   Copied deferred file C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\Logs\dosvc.20260818_014119_159.etl to C:\kape_out\C\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\Logs\dosvc.20260818_014119_159.etl. Hashing source file...
[2026-08-19 05:04:51.2512593 | INF]   Copied deferred file C:\Windows\System32\wbem\Repository\INDEX.BTR to C:\kape_out\C\Windows\System32\wbem\Repository\INDEX.BTR. Hashing source file...
[2026-08-19 05:04:51.3299410 | INF]   Copied deferred file C:\Windows\System32\wbem\Repository\MAPPING1.MAP to C:\kape_out\C\Windows\System32\wbem\Repository\MAPPING1.MAP. Hashing source file...
[2026-08-19 05:04:51.3768178 | INF]   Copied deferred file C:\Windows\System32\wbem\Repository\MAPPING2.MAP to C:\kape_out\C\Windows\System32\wbem\Repository\MAPPING2.MAP. Hashing source file...
[2026-08-19 05:04:51.4237285 | INF]   Copied deferred file C:\Windows\System32\wbem\Repository\MAPPING3.MAP to C:\kape_out\C\Windows\System32\wbem\Repository\MAPPING3.MAP. Hashing source file...
[2026-08-19 05:04:53.4604161 | INF]   Copied deferred file C:\Windows\System32\wbem\Repository\OBJECTS.DATA to C:\kape_out\C\Windows\System32\wbem\Repository\OBJECTS.DATA. Hashing source file...
[2026-08-19 05:04:53.5235546 | INF]   Copied deferred file C:\Users\sgonk\AppData\Local\Microsoft\Edge\User Data\Default\Favicons to C:\kape_out\C\Users\sgonk\AppData\Local\Microsoft\Edge\User Data\Default\Favicons. Hashing source file...
[2026-08-19 05:04:53.5541458 | INF]   Copied deferred file C:\Users\sgonk\AppData\Local\Microsoft\Edge\User Data\Default\History to C:\kape_out\C\Users\sgonk\AppData\Local\Microsoft\Edge\User Data\Default\History. Hashing source file...
[2026-08-19 05:04:53.5541458 | INF]   Copied deferred file C:\Users\sgonk\AppData\Local\Microsoft\Edge\User Data\Default\History-journal to C:\kape_out\C\Users\sgonk\AppData\Local\Microsoft\Edge\User Data\Default\History-journal. Hashing source file...
[2026-08-19 05:04:53.6010786 | INF]   Copied deferred file C:\Users\sgonk\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13431600411059163 to C:\kape_out\C\Users\sgonk\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13431600411059163. Hashing source file...
[2026-08-19 05:04:53.6821918 | INF]   Copied deferred file C:\Users\sgonk\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13431600411153160 to C:\kape_out\C\Users\sgonk\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13431600411153160. Hashing source file...
[2026-08-19 05:04:53.6979473 | INF]   Copied deferred file C:\Users\sgonk\AppData\Local\Microsoft\Edge\User Data\Default\Login Data to C:\kape_out\C\Users\sgonk\AppData\Local\Microsoft\Edge\User Data\Default\Login Data. Hashing source file...
[2026-08-19 05:04:53.7446760 | INF]   Copied deferred file C:\Users\sgonk\AppData\Local\Microsoft\Edge\User Data\Default\Network Action Predictor to C:\kape_out\C\Users\sgonk\AppData\Local\Microsoft\Edge\User Data\Default\Network Action Predictor. Hashing source file...
[2026-08-19 05:04:53.7813454 | INF]   Copied deferred file C:\Users\sgonk\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts to C:\kape_out\C\Users\sgonk\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts. Hashing source file...
[2026-08-19 05:04:53.8366151 | INF]   Copied deferred file C:\Users\sgonk\AppData\Local\Microsoft\Edge\User Data\Default\Web Data to C:\kape_out\C\Users\sgonk\AppData\Local\Microsoft\Edge\User Data\Default\Web Data. Hashing source file...
[2026-08-19 05:04:54.0085156 | INF]   Copied deferred file C:\Users\sgonk\AppData\Local\Microsoft\Internet Explorer\CacheStorage\edb.log to C:\kape_out\C\Users\sgonk\AppData\Local\Microsoft\Internet Explorer\CacheStorage\edb.log. Hashing source file...
[2026-08-19 05:04:54.1952524 | INF]   Copied deferred file C:\Users\sgonk\AppData\Local\Microsoft\Windows\WebCache\V01.log to C:\kape_out\C\Users\sgonk\AppData\Local\Microsoft\Windows\WebCache\V01.log. Hashing source file...
[2026-08-19 05:04:54.2767829 | INF]   Copied deferred file C:\Users\sgonk\AppData\Local\Microsoft\Windows\WebCache\V01tmp.log to C:\kape_out\C\Users\sgonk\AppData\Local\Microsoft\Windows\WebCache\V01tmp.log. Hashing source file...
[2026-08-19 05:04:57.0184305 | INF]   Copied deferred file C:\Users\sgonk\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat to C:\kape_out\C\Users\sgonk\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat. Hashing source file...
[2026-08-19 05:04:57.0184305 | INF]   Copied deferred file C:\Users\sgonk\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.jfm to C:\kape_out\C\Users\sgonk\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.jfm. Hashing source file...
[2026-08-19 05:04:57.1277617 | INF]   Copied deferred file C:\Users\sgonk\AppData\Local\ConnectedDevicesPlatform\L.sgonk\ActivitiesCache.db to C:\kape_out\C\Users\sgonk\AppData\Local\ConnectedDevicesPlatform\L.sgonk\ActivitiesCache.db. Hashing source file...
[2026-08-19 05:04:57.1436972 | INF]   Copied deferred file C:\Users\sgonk\AppData\Local\ConnectedDevicesPlatform\L.sgonk\ActivitiesCache.db-shm to C:\kape_out\C\Users\sgonk\AppData\Local\ConnectedDevicesPlatform\L.sgonk\ActivitiesCache.db-shm. Hashing source file...
[2026-08-19 05:04:57.6324840 | INF]   Copied deferred file C:\Users\sgonk\AppData\Local\ConnectedDevicesPlatform\L.sgonk\ActivitiesCache.db-wal to C:\kape_out\C\Users\sgonk\AppData\Local\ConnectedDevicesPlatform\L.sgonk\ActivitiesCache.db-wal. Hashing source file...
[2026-08-19 05:04:57.6324840 | INF] Copied 1,133 (Deduplicated: 176) out of 1,309 files in 304.8257 seconds. See C:\kape_out\2026-08-19T09_59_51_2381976_CopyLog.csv for copy details
[2026-08-19 05:04:57.6324840 | INF] Using Module operations
[2026-08-19 05:04:57.6481717 | WRN]   Flushing module destination directory C:\kape_parsed
[2026-08-19 05:04:57.6481717 | WRN]   Creating module destination directory C:\kape_parsed
[2026-08-19 05:04:57.6541395 | INF]   Module AmcacheParser: Found 1 processor
[2026-08-19 05:04:57.6541395 | INF]     Found processor Executable: AmcacheParser.exe, Cmd line: -f %sourceFile% --csv %destinationDirectory% -i --mp, Export: csv, Append: False!
[2026-08-19 05:04:57.6541395 | INF]   Module AppCompatCacheParser: Found 1 processor
[2026-08-19 05:04:57.6541395 | INF]     Found processor Executable: AppCompatCacheParser.exe, Cmd line: -f %sourceFile% --csv %destinationDirectory%, Export: csv, Append: False!
[2026-08-19 05:04:57.6541395 | INF]   Module EvtxECmd: Found 3 processors
[2026-08-19 05:04:57.6697908 | INF]     Found processor Executable: EvtxECmd\EvtxECmd.exe, Cmd line: -d %sourceDirectory% --csv %destinationDirectory%, Export: csv, Append: False!
[2026-08-19 05:04:57.6697908 | INF]   Module JLECmd: Found 3 processors
[2026-08-19 05:04:57.6697908 | INF]     Found processor Executable: JLECmd.exe, Cmd line: -d %sourceDirectory% --csv %destinationDirectory% -q --mp, Export: csv, Append: False!
[2026-08-19 05:04:57.6697908 | INF]   Module LECmd: Found 3 processors
[2026-08-19 05:04:57.6697908 | INF]     Found processor Executable: LECmd.exe, Cmd line: -d %sourceDirectory% --csv %destinationDirectory% -q --mp, Export: csv, Append: False!
[2026-08-19 05:04:57.6697908 | INF]   Module MFTECmd: Found 4 processors
[2026-08-19 05:04:57.6859497 | INF]   Module MFTECmd_$Boot: Found 2 processors
[2026-08-19 05:04:57.6859497 | INF]     Found processor Executable: MFTECmd.exe, Cmd line: -f %sourceFile% --csv %destinationDirectory%, Export: csv, Append: False!
[2026-08-19 05:04:57.6859497 | INF]   Module MFTECmd_$MFT: Found 2 processors
[2026-08-19 05:04:57.6859497 | INF]     Found processor Executable: MFTECmd.exe, Cmd line: -f %sourceFile% --csv %destinationDirectory%, Export: csv, Append: False!
[2026-08-19 05:04:57.6859497 | INF]   Module MFTECmd_$J: Found 2 processors
[2026-08-19 05:04:57.6859497 | INF]     Found processor Executable: MFTECmd.exe, Cmd line: -f %sourceFile% --csv %destinationDirectory%, Export: csv, Append: False!
[2026-08-19 05:04:57.7017184 | INF]   Module MFTECmd_$SDS: Found 2 processors
[2026-08-19 05:04:57.7017184 | INF]     Found processor Executable: MFTECmd.exe, Cmd line: -f %sourceFile% --csv %destinationDirectory%, Export: csv, Append: False!
[2026-08-19 05:04:57.7017184 | INF]   Module PECmd: Found 3 processors
[2026-08-19 05:04:57.7017184 | INF]     Found processor Executable: PECmd.exe, Cmd line: -d %sourceDirectory% --csv %destinationDirectory% --mp -q, Export: csv, Append: False!
[2026-08-19 05:04:57.7017184 | INF]   Module RBCmd: Found 1 processor
[2026-08-19 05:04:57.7017184 | INF]     Found processor Executable: RBCmd.exe, Cmd line: -d %sourceDirectory% --csv %destinationDirectory% -q, Export: csv, Append: False!
[2026-08-19 05:04:57.7017184 | INF]   Module RecentFileCacheParser: Found 2 processors
[2026-08-19 05:04:57.7173107 | INF]     Found processor Executable: RecentFileCacheParser.exe, Cmd line: -f %sourceFile% --csv %destinationDirectory%, Export: csv, Append: False!
[2026-08-19 05:04:57.7173107 | INF]   Module RECmd_Kroll: Found 1 processor
[2026-08-19 05:04:57.7173107 | INF]     Found processor Executable: RECmd\RECmd.exe, Cmd line: -d %sourceDirectory% --bn BatchExamples\Kroll_Batch.reb --nl false --csv %destinationDirectory%, Export: csv, Append: False!
[2026-08-19 05:04:57.7173107 | INF]   Module SBECmd: Found 1 processor
[2026-08-19 05:04:57.7274140 | INF]     Found processor Executable: SBECmd.exe, Cmd line: -d %sourceDirectory% --csv %destinationDirectory%, Export: csv, Append: False!
[2026-08-19 05:04:57.7295081 | INF]   Module SQLECmd: Found 2 processors
[2026-08-19 05:04:57.7306131 | INF]     Found processor Executable: SQLECmd\SQLECmd.exe, Cmd line: -d %sourceDirectory% --csv %destinationDirectory%, Export: csv, Append: False!
[2026-08-19 05:04:57.7319891 | INF]   Module SrumECmd: Found 1 processor
[2026-08-19 05:04:57.7326863 | INF]     Found processor Executable: SrumECmd.exe, Cmd line: -d %sourceDirectory% --csv %destinationDirectory%, Export: csv, Append: False!
[2026-08-19 05:04:57.7326863 | INF]   Module SumECmd: Found 1 processor
[2026-08-19 05:04:57.7326863 | INF]     Found processor Executable: SumECmd.exe, Cmd line: -d %sourceDirectory%\Windows\System32\LogFiles\SUM --csv %destinationDirectory%, Export: csv, Append: False!
[2026-08-19 05:04:57.7326863 | INF]   Module WxTCmd: Found 1 processor
[2026-08-19 05:04:57.7326863 | INF]     Found processor Executable: WxTCmd.exe, Cmd line: -f %sourceFile% --csv %destinationDirectory%, Export: csv, Append: False!
[2026-08-19 05:04:57.7326863 | INF] Discovered 18 processors to run
[2026-08-19 05:04:57.7326863 | INF] Executing modules with file masks...
[2026-08-19 05:04:57.7624155 | INF]   Running AmcacheParser.exe: -f "C:\kape_out\C\Windows\AppCompat\Programs\Amcache.hve" --csv C:\kape_parsed\ProgramExecution -i --mp
[2026-08-19 05:04:59.5070694 | INF]   Running AppCompatCacheParser.exe: -f "C:\kape_out\C\Windows\System32\config\SYSTEM" --csv C:\kape_parsed\ProgramExecution
[2026-08-19 05:05:00.8344352 | INF]   Running MFTECmd.exe: -f "C:\kape_out\C\$Boot" --csv C:\kape_parsed\FileSystem
[2026-08-19 05:05:01.5070928 | INF]   Running MFTECmd.exe: -f "C:\kape_out\C\$MFT" --csv C:\kape_parsed\FileSystem
[2026-08-19 05:05:17.4887208 | INF]   Running MFTECmd.exe: -f "C:\kape_out\C\$Extend\$J" --csv C:\kape_parsed\FileSystem
[2026-08-19 05:05:20.8992628 | INF]   Running MFTECmd.exe: -f "C:\kape_out\C\$Secure_$SDS" --csv C:\kape_parsed\FileSystem
[2026-08-19 05:05:21.3534172 | INF]   Skipping RecentFileCacheParser.exe: No matching files found for RecentFileCache.bcf!
[2026-08-19 05:05:21.3851903 | INF]   Running WxTCmd.exe: -f "C:\kape_out\C\Users\defaultuser0\AppData\Local\ConnectedDevicesPlatform\L.defaultuser0\ActivitiesCache.db" --csv C:\kape_parsed\FileFolderAccess
[2026-08-19 05:05:25.0141684 | INF]   Running WxTCmd.exe: -f "C:\kape_out\C\Users\sgonk\AppData\Local\ConnectedDevicesPlatform\L.sgonk\ActivitiesCache.db" --csv C:\kape_parsed\FileFolderAccess
[2026-08-19 05:05:25.3628448 | INF]   Running WxTCmd.exe: -f "C:\kape_out\C\Users\Stanley Gonk\AppData\Local\ConnectedDevicesPlatform\L.Stanley Gonk\ActivitiesCache.db" --csv C:\kape_parsed\FileFolderAccess
[2026-08-19 05:05:25.8426908 | INF] Executing remaining modules...
[2026-08-19 05:05:25.8426908 | INF]   Running EvtxECmd\EvtxECmd.exe: -d C:\kape_out --csv C:\kape_parsed\EventLogs
[2026-08-19 05:05:52.1468628 | INF]   Running JLECmd.exe: -d C:\kape_out --csv C:\kape_parsed\FileFolderAccess -q --mp
[2026-08-19 05:05:52.7027296 | INF]   Running LECmd.exe: -d C:\kape_out --csv C:\kape_parsed\FileFolderAccess -q --mp
[2026-08-19 05:05:53.1941405 | INF]   Running PECmd.exe: -d C:\kape_out --csv C:\kape_parsed\ProgramExecution --mp -q
[2026-08-19 05:05:53.9763213 | INF]   Running RBCmd.exe: -d C:\kape_out --csv C:\kape_parsed\FileDeletion -q
[2026-08-19 05:05:54.3225398 | INF]   Running RECmd\RECmd.exe: -d C:\kape_out --bn BatchExamples\Kroll_Batch.reb --nl false --csv C:\kape_parsed\Registry
[2026-08-19 05:06:05.0552255 | INF]   Running SBECmd.exe: -d C:\kape_out --csv C:\kape_parsed\FileFolderAccess
[2026-08-19 05:06:06.1129412 | INF]   Running SQLECmd\SQLECmd.exe: -d C:\kape_out --csv C:\kape_parsed\SQLDatabases
[2026-08-19 05:06:06.7447787 | INF]   Running SrumECmd.exe: -d C:\kape_out --csv C:\kape_parsed\SRUMDatabase
[2026-08-19 05:06:08.5462790 | INF]   Running SumECmd.exe: -d C:\kape_out\Windows\System32\LogFiles\SUM --csv C:\kape_parsed\SUMDatabase
[2026-08-19 05:06:08.8575733 | INF] Executed 18 processors in 71.2042 seconds
[2026-08-19 05:06:08.8608101 | INF] Total execution time: 376.0473 seconds
