MS Regedit Hex to Date Conversion

I'm trying to analyze my redundant network profiles on Win 10 via registry path:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles

However, I'm unable to interpret the date from the hex format representation.

Eg:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles\{GUID}]
"ProfileName"="XXXXXXXXX"
"Description"="XXXXXXXXX"
"Managed"=dword:00000000
"Category"=dword:00000000
"DateCreated"=hex:e4,07,05,00,04,00,0e,00,14,00,16,00,06,00,8b,01
"NameType"=dword:00000047
"DateLastConnected"=hex:e4,07,05,00,04,00,0e,00,14,00,30,00,30,00,04,03

How can I convert the hex e4,07,05,00,04,00,0e,00,14,00,16,00,06,00,8b,01 to something more readable? A reusable solution would be more helpful.

2 Answers

You have 3 possible methods:

Manually

The third method is described [here] for Windows 7 but it is also working with Windows 10. Applying the method described on that page, gives the following steps:

1. Convert your date from little endian to big endian. For example your date create is: e407 0500 0400 0e00 1400 1600 0600 8b01 (I have put the spaces to better visualize). To convert to big endian, swap every 2 bytes, you will get 07e4 0005 0004 000e 0014 0016 0006 018b
2. You get the year from converting 07e4 to decimal: 2020.
3. The month 00005 to decimal: 5 = May
4. Then the day of the week 0004 to decimal : 4 = Thursday
5. The day 000e to decimal: 14 = 14th day of the month
6. The hour 0014 to decimal: 20 = 20:00 or 08:00 PM
7. The minutes 0016 to decimal: 22 = 22 minutes
8. The seconds 0006 to decimal:6 = 6 seconds
9. The thousandth seconds 018b to decimal 395 = 0.395 second.

Your created date is/was 2020 May 14, 20:22:06.395.

Using Powershell

You can try to use PowerShell as described here.

Using DCode

Another possibility is to use Dcode. Insert the hex date you want to convert, select Hexadecimal (Little Endian) as the format then click on Decode button.

Using Python 3.9:

n=list(map(str,input("Enter Hex value : ").split(",")))
l1=[]
l2=[]
for i in range(0,len(n),2): l1.append(n[i])
for j in range(1,len(n),2): l2.append(n[j])
l3=[str (x) + str (y) for x, y in zip (l2, l1)]
print("Date (YYYY/MM/DD): ")
for i in range(len(l3)): if i!=2 and i<4: res = int(l3[i], 16) print(res,end="/")
print("\n")
print("Time (HH:mm:ss:ms): ")
for i in range(len(l3)): if i>3: res = int(l3[i], 16) print(res,end=":")