WolfLauncher: add execution timestamp to the outline

DFIR-ORC · Jul 31, 2020 · abaedd8 · abaedd8
1 parent 1542a2c
commit abaedd8
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/src/OrcCommand/WolfLauncher_Run.cpp b/src/OrcCommand/WolfLauncher_Run.cpp
@@ -214,6 +214,10 @@ HRESULT Orc::Command::Wolf::Main::CreateAndUploadOutline()
             GetSystemTimeAsFileTime(&ft);
             writer->WriteNamed(L"time", ft);
 
+            std::wstring strTimeStamp;
+            SystemDetails::GetTimeStamp(strTimeStamp);
+            writer->WriteNamed(L"timestamp", strTimeStamp.c_str());
+
             auto mothership_id = SystemDetails::GetParentProcessId(_L_);
             if (mothership_id)
             {