Decodes the DateCreated and DateLastCreated timestamp structures. See structure description here: http://cfed-ttf.blogspot.com/2009/08/decoding-datecreated-and.html

decode_DateCreated.py

import sys
from datetime import datetime
import struct

buf = sys.stdin.read().rstrip("\r\n")
y, mo, w, d, h, mi, s, _ = struct.unpack("<HHHHHHHH", buf)
print datetime(y, mo, d, h, mi, s).isoformat("T") + "Z"

Example:

~  » regfetch "HLKM\Software\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles\{GUID}" "DateCreated" | python DateLastConnected.py
2014-01-07T11:27:43Z