winevtx parser failing to extract creation time in not well-formed XML string

[joachimmetz]

As flagged in #442 Windows Event Log XML is not necessary proper (well-formed) XML. This is causing the winevtx to error on certain evtx files. Change the parser to use an alternative approach to extract the TimeCreated value.

******************************** Warning: 12627 ********************************
           Message : unable to parse XML string of event record: 26301 with
                     error: not well-formed (invalid token): line 20, column 55
      Parser chain : winevtx
Path specification : type: OS, location: image.E01
                   : type: EWF
                   : type: NTFS, location:
                     \Windows\System32\winevt\Logs\Microsoft-Windows-Store%4Operational.evtx,
                     MFT attribute: 2, MFT entry: 32230
--------------------------------------------------------------------------------

[joachimmetz]

Related issue #442

[joachimmetz]

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Store" Guid="{9C2A37F3-E5FD-5CAE-BCD1-43DAFEEE1FF0}"/>
    <EventID>8001</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>8001</Task>
    <Opcode>14</Opcode>
    <Keywords>0x8000100000000000</Keywords>
    <TimeCreated SystemTime="2018-09-03T01:54:01.996300600Z"/>
    <EventRecordID>218351</EventRecordID>
    <Correlation/>
    <Execution ProcessID="784" ThreadID="4980"/>
    <Channel>Microsoft-Windows-Store/Operational</Channel>
    <Computer>base-wkstn-01.shieldbase.lan</Computer>
    <Security UserID="S-1-5-19"/>
  </System>
  <EventData>
    <Data Name="Message">[1374] [000001B9730DC1F0:558F5D32-0827-EB7B-6AD6-D5DB4138B3AA] StopProcessing : Key:NegotiatingUnleased</Data>
    <Data Name="Function">StateMachine<class KeyMachine,class KeyState>::PumpEvents</Data>
    <Data Name="Source">onecoreuap\enduser\winstore\licensemanager\lib\statemachine.h</Data>
    <Data Name="Line Number">173</Data>
  </EventData>
</Event>

The culprit <Data Name="Function">StateMachine<class KeyMachine,class KeyState>::PumpEvents</Data>. AFAIK well-formed XML should not contain < in the XML element data. Confirmed this with Windows EventViewer.