Zircolite seems to hang on extracting evtx logs about zircolite HOT 6 CLOSED

Thanks !
I will check ASAP, but it is generally linked to evtx_dump (https://github.com/omerbenamram/evtx ) that get stuck by himself.

from zircolite.

Running the evtx command independently works and it does not get stuck so maybe this has to do with the way pipes are created?

from zircolite.

If you pass --noexternal as an argument it will use the bindings instead of dropping the binary (but it is slower). Can you try please ?

from zircolite.

Yes that works well. Thank you :-). Perhaps it should be the default setting. Compared to the time taken by the rest of the code the few seconds that can be saved in this step are probably insignificant overall.

from zircolite.

You’re right, I think it will be the default behavior in next commit (and release…).
The fact that Zircolite was dropping the evtx_dump binary always seemed « messy » to me.

from zircolite.

Done.

from zircolite.