Small change for filetime conversion

2013-11-17 22:26:30 +02:00
parent b73260b74c
commit b2e7ff4587
1 changed files with 1 additions and 1 deletions
@@ -82,7 +82,7 @@ class Metasploit3 < Msf::Post
      path_hash = prefetch_file[hash_offset..hash_offset+4].unpack('h8')[0].reverse.upcase.to_s

      # Last we get the latest execution time
-      filetime_a = prefetch_file[filetime_offset..(filetime_offset+16)].unpack('q32')
+      filetime_a = prefetch_file[filetime_offset..(filetime_offset+16)].unpack('q*')
      filetime = filetime_a[0] + filetime_a[1]
      last_exec = Time.at((filetime - 116444736000000000) / 10000000).utc.to_s