All the evtx I've been trying to create from XML are corrupted and can't be properly opened by the Windows Event Viewer : the first events look OK but then an event is infinitely cloned and the wizard says that the etvx is damaged.
See the screenshot below for how it looks (sorry it's in french).
The same happens for the xml files I have on my side or the xml files created by create_eventlog.py.
I think there's an issue with the chunks. I have this behaviour only with evtx that have a number of chunks > 1.
All the evtx I've been trying to create from XML are corrupted and can't be properly opened by the Windows Event Viewer : the first events look OK but then an event is infinitely cloned and the wizard says that the etvx is damaged.
See the screenshot below for how it looks (sorry it's in french).
The same happens for the xml files I have on my side or the xml files created by create_eventlog.py.
I think there's an issue with the chunks. I have this behaviour only with evtx that have a number of chunks > 1.