{"action":"created","issue":{"url":"https://api.github.com/repos/log2timeline/plaso/issues/1724","repository_url":"https://api.github.com/repos/log2timeline/plaso","labels_url":"https://api.github.com/repos/log2timeline/plaso/issues/1724/labels{/name}","comments_url":"https://api.github.com/repos/log2timeline/plaso/issues/1724/comments","events_url":"https://api.github.com/repos/log2timeline/plaso/issues/1724/events","html_url":"https://github.com/log2timeline/plaso/issues/1724","id":297824629,"number":1724,"title":"Duplicated events with incorrect timestamp","user":{"login":"lc4nt","id":36400122,"avatar_url":"https://avatars2.githubusercontent.com/u/36400122?v=4","gravatar_id":"","url":"https://api.github.com/users/lc4nt","html_url":"https://github.com/lc4nt","followers_url":"https://api.github.com/users/lc4nt/followers","following_url":"https://api.github.com/users/lc4nt/following{/other_user}","gists_url":"https://api.github.com/users/lc4nt/gists{/gist_id}","starred_url":"https://api.github.com/users/lc4nt/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lc4nt/subscriptions","organizations_url":"https://api.github.com/users/lc4nt/orgs","repos_url":"https://api.github.com/users/lc4nt/repos","events_url":"https://api.github.com/users/lc4nt/events{/privacy}","received_events_url":"https://api.github.com/users/lc4nt/received_events","type":"User","site_admin":false},"labels":[{"id":127907854,"url":"https://api.github.com/repos/log2timeline/plaso/labels/bug","name":"bug","color":"fc2929","default":true}],"state":"open","locked":false,"assignee":{"login":"Onager","id":1298404,"avatar_url":"https://avatars3.githubusercontent.com/u/1298404?v=4","gravatar_id":"","url":"https://api.github.com/users/Onager","html_url":"https://github.com/Onager","followers_url":"https://api.github.com/users/Onager/followers","following_url":"https://api.github.com/users/Onager/following{/other_user}","gists_url":"https://api.github.com/users/Onager/gists{/gist_id}","starred_url":"https://api.github.com/users/Onager/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Onager/subscriptions","organizations_url":"https://api.github.com/users/Onager/orgs","repos_url":"https://api.github.com/users/Onager/repos","events_url":"https://api.github.com/users/Onager/events{/privacy}","received_events_url":"https://api.github.com/users/Onager/received_events","type":"User","site_admin":false},"assignees":[{"login":"Onager","id":1298404,"avatar_url":"https://avatars3.githubusercontent.com/u/1298404?v=4","gravatar_id":"","url":"https://api.github.com/users/Onager","html_url":"https://github.com/Onager","followers_url":"https://api.github.com/users/Onager/followers","following_url":"https://api.github.com/users/Onager/following{/other_user}","gists_url":"https://api.github.com/users/Onager/gists{/gist_id}","starred_url":"https://api.github.com/users/Onager/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Onager/subscriptions","organizations_url":"https://api.github.com/users/Onager/orgs","repos_url":"https://api.github.com/users/Onager/repos","events_url":"https://api.github.com/users/Onager/events{/privacy}","received_events_url":"https://api.github.com/users/Onager/received_events","type":"User","site_admin":false}],"milestone":null,"comments":3,"created_at":"2018-02-16T15:35:53Z","updated_at":"2018-03-08T16:50:41Z","closed_at":null,"author_association":"NONE","body":"**Description of problem:**\r\n\r\nIn the last version of Plaso, we are seeing certain events being duplicated with a wrong timestamp, that might lead an investigator to wrong assumptions. The problem *seems* related only to evtx parsing. Here's an example with anonymized data:\r\n\r\n20180127 version. The real event is the one from `2018-02-07T12:04:26+00:00`, all the others never happened:\r\n```\r\n[user@server] $ cat latest.csv | grep -i inject\r\n2017-12-22T09:43:47.125000+00:00,Content Modification Time,EVT,WinEVTX,[258 / 0x0102] Source Name: MyAVEvent Strings: ['The file c:\\Documents and Settings\\InnocentUser\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\73YTJFYZ\\inject[1].js contains  Trojan.   Record Number: 29731 Event Level: 3,winevtx,OS:/somewhere/evtxlogs/application.evtx,-\r\n2018-01-16T12:57:07.915036+00:00,Content Modification Time,EVT,WinEVTX,[258 / 0x0102] Source Name: MyAVEvent Strings: ['The file c:\\Documents and Settings\\InnocentUser\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\73YTJFYZ\\inject[1].js contains  Trojan.   Record Number: 29731 Event Level: 3,winevtx,OS:/somewhere/evtxlogs/application.evtx,-\r\n2018-01-29T15:07:34+00:00,Content Modification Time,EVT,WinEVTX,[258 / 0x0102] Source Name: MyAVEvent Strings: ['The file c:\\Documents and Settings\\InnocentUser\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\73YTJFYZ\\inject[1].js contains  Trojan.   Record Number: 29731 Event Level: 3,winevtx,OS:/somewhere/evtxlogs/application.evtx,-\r\n2018-02-07T12:04:26+00:00,Content Modification Time,EVT,WinEVTX,[258 / 0x0102] Source Name: MyAVEvent Strings: ['The file c:\\Documents and Settings\\InnocentUser\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\73YTJFYZ\\inject[1].js contains  Trojan.   Record Number: 29731 Event Level: 3,winevtx,OS:/somewhere/evtxlogs/application.evtx,-\r\n2018-02-13T16:02:30.934406+00:00,Content Modification Time,EVT,WinEVTX,[258 / 0x0102] Source Name: MyAVEvent Strings: ['The file c:\\Documents and Settings\\InnocentUser\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\73YTJFYZ\\inject[1].js contains  Trojan.   Record Number: 29731 Event Level: 3,winevtx,OS:/somewhere/evtxlogs/application.evtx,-\r\n```\r\n\r\n20171231 version. This is correct.\r\n```\r\n[user@server] $ cat 311217.csv | grep inject\r\n2018-02-07T12:04:26+00:00,Content Modification Time,EVT,WinEVTX,[258 / 0x0102] Source Name: MyAVEvent Strings: ['The file c:\\Documents and Settings\\InnocentUser\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\73YTJFYZ\\inject[1].js contains  Trojan.  Record Number: 29731 Event Level: 3,winevtx,OS:/somewhere/evtxlogs/application.evtx,-\r\n```\r\n\r\nThe `create.log` file contains parsing error in both the cases:\r\n`Number of errors encountered while extracting events: XY`.\r\n\r\nHowever, this doesn't look relevant, as the amount of errors is the same in both the cases.\r\n\r\n**Command line and arguments:**\r\nPlaso runs in a docker image based on ubuntu 16:04\r\nThe relevant command line for log2timeline is the following:\r\n\r\n`log2timeline --status_view linear /path/file.plaso /path/evtxlogs/whatever.evtx`\r\n\r\n\r\n**Source data:**\r\n\r\nUnfortunately I can't provide this.\r\n\r\n**Plaso version:**\r\n\r\nThe bug affects  20180127. \r\n\r\n**Operating system Plaso is running on:**\r\n\r\nDocker container based on Ubuntu 16:04.\r\n\r\n**Installation method:**\r\n\r\nFrom dockerfile:\r\n```\r\nRUN add-apt-repository -y \"deb http://ppa.launchpad.net/gift/stable/ubuntu xenial main\"\r\n```\r\n\r\n**Debug output/tracebacks:**\r\n\r\nPlease let me know if the data I've provided it's enough to start an investigation. If you need more logs, I need to anonymize them before providing.\r\n\r\nThanks\r\n"},"comment":{"url":"https://api.github.com/repos/log2timeline/plaso/issues/comments/371548370","html_url":"https://github.com/log2timeline/plaso/issues/1724#issuecomment-371548370","issue_url":"https://api.github.com/repos/log2timeline/plaso/issues/1724","id":371548370,"user":{"login":"Onager","id":1298404,"avatar_url":"https://avatars3.githubusercontent.com/u/1298404?v=4","gravatar_id":"","url":"https://api.github.com/users/Onager","html_url":"https://github.com/Onager","followers_url":"https://api.github.com/users/Onager/followers","following_url":"https://api.github.com/users/Onager/following{/other_user}","gists_url":"https://api.github.com/users/Onager/gists{/gist_id}","starred_url":"https://api.github.com/users/Onager/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Onager/subscriptions","organizations_url":"https://api.github.com/users/Onager/orgs","repos_url":"https://api.github.com/users/Onager/repos","events_url":"https://api.github.com/users/Onager/events{/privacy}","received_events_url":"https://api.github.com/users/Onager/received_events","type":"User","site_admin":false},"created_at":"2018-03-08T16:50:41Z","updated_at":"2018-03-08T16:50:41Z","author_association":"CONTRIBUTOR","body":"The debug logs actually look OK, is the version of libevtx different between the two versions, by any chance? Is the output of evtxexport for this file what you expect, or different?"}}
{"actor":{"display_login":"Onager"}}