.NET Core app. I am detecting when a new process is created using WMI, with something like
WqlEventQuery wqlEventQuery = new WqlEventQuery(string.Format("SELECT * FROM Win32_ProcessStartTrace"));
This seems to be working ok, and it detects if I open any app. But the value of property TIME_CREATED
is not showing what I expected…
from Microsoft:
“Unique value that indicates the time at which the event was
generated. This is a 64-bit value that represents the number of
100-nanosecond intervals after January 1, 1601. The information is in
the Coordinated Universal Times (UTC) format. “
But, if I convert this timestamp to DateTime, it gives me a bizarre value… For example, it detects a new process started, and the property TIME_CREATED
shows a value of 133598139347539533. But converting this to a datetime, it should give the today’s date, but it is instead 24/07/5834…
Also, I have found that DateTime.Now.ToFileTimeUtc()
returns the current timestamp for that same epoch (1601), so I have tried it and yes, it gives the expected result (something like 133598169181757776), so I know my calculations are ok…
Any ideas?