Querying WMI class Win32_QuickFixEngineering returns mucho weirdo timestamps (C#)

Question

Class documentation here. The InstalledOn property is supposed to have a timestamp of (well, duh) when the fix was installed. But the doc doesn't say what's the format. I get something unintelligible, but it clearly means something. "01ca56402c180b70" is very obvious a hex number, but of what?

And another thing: why do the first few items look like GUIDs? What do they mean?

Da code:

ManagementScope scope;
ConnectionOptions options = new ConnectionOptions();
options.Username = tbUsername.Text;
options.Password = tbPassword.Password;
options.Authority = String.Format("ntlmdomain:{0}", tbDomain.Text);
scope = new ManagementScope(String.Format("\\\\{0}\\root\\cimv2", tbHost.Text), options);
scope.Connect();
ManagementObjectSearcher searcher = new ManagementObjectSearcher(scope, new ObjectQuery("SELECT * FROM Win32_QuickFixEngineering"));
foreach (ManagementObject queryObj in searcher.Get())
{
    wmiResults.Text += String.Format("{0} <{1}>: {2} (Installed {3} by '{4}')",
                                     queryObj["HotFixID"],
                                     queryObj["Caption"],
                                     queryObj["Description"],
                                     queryObj["InstalledOn"],
                                     queryObj["InstalledBy"]
                                     );
}

Da output:

{87796B93-94D0-A0C7-EFC4-FF34426626BC} <>:  (Installed 20090513 by '')
{D93F9C7C-AB57-44C8-BAD6-1494674BCAF7} <>:  (Installed 20090928 by '')
{9AD2FB23-AC50-435C-8ABC-8119D29CF0C1} <>:  (Installed 20090929 by '')
{62D3B51B-F56D-40F0-8C32-EAB204ADF752} <>:  (Installed 20090513 by '')
{EC038F86-AC1E-4C30-AEFB-B6B8A3922DCD} <>:  (Installed 20091116 by '')
{D1219E04-62FF-49D0-804C-A27F968E50A5} <>:  (Installed 20091116 by '')
{1DE62EBA-6684-2483-3409-CEBADBF8A31E} <>:  (Installed 20090513 by '')
{8CA89076-2A6D-42C3-AA24-F203C9E5DBF3} <>:  (Installed 20090513 by '')
{F5E29D9D-519A-36C7-87E3-9A22A8180B1B} <>:  (Installed 20091016 by '')
KB948609 <http://support.microsoft.com/?kbid=948609&gt;: Update (Installed 01c9d3cb9b46a87c by 'S-1-5-21-2756995651-916083937-3196967445-500')
KB948610 <http://support.microsoft.com/?kbid=948610&gt;: Update (Installed 01c9d3cb9b4909dd by 'S-1-5-21-2756995651-916083937-3196967445-500')
KB951978 <http://support.microsoft.com/?kbid=951978&gt;: Update (Installed 01ca408d02d6cdbe by 'S-1-5-18')
KB952287 <http://support.microsoft.com/?kbid=952287&gt;: Hotfix (Installed 01ca408d02d925c8 by 'S-1-5-18')
KB954155 <http://support.microsoft.com/?kbid=954155&gt;: Security Update (Installed 01ca56402c10e74d by 'S-1-5-18')
KB955020 <http://support.microsoft.com/?kbid=955020&gt;: Update (Installed 01ca408d02d925c8 by 'S-1-5-18')
KB955302 <http://support.microsoft.com/?kbid=955302&gt;: Update (Installed 01ca408d02db7dd2 by 'S-1-5-18')
KB956250 <http://support.microsoft.com&gt;: Update (Installed 01ca66e5e6fc6b70 by 'S-1-5-21-501351562-481299158-1019697294-11592')
KB958481 <http://support.microsoft.com/?kbid=958481&gt;: Update (Installed 01ca408d02db7dd2 by 'S-1-5-18')
KB958483 <http://support.microsoft.com/?kbid=958483&gt;: Update (Installed 01ca408d02ddd5dc by 'S-1-5-18')
KB958644 <http://support.microsoft.com/?kbid=958644&gt;: Security Update (Installed 01ca57f748bfe059 by 'S-1-5-21-2756995651-916083937-3196967445-500')
KB958869 <http://support.microsoft.com/?kbid=958869&gt;: Security Update (Installed 01ca56402c10e74d by 'S-1-5-18')
KB959772 <http://support.microsoft.com/?kbid=959772&gt;: Update (Installed 01ca408d02ddd5dc by 'S-1-5-18')
KB968389 <http://support.microsoft.com/?kbid=968389&gt;: Update (Installed 01ca408d02e02de6 by 'S-1-5-18')
KB968816 <http://support.microsoft.com/?kbid=968816&gt;: Security Update (Installed 01ca45c1ebfd041f by 'S-1-5-18')
KB971486 <http://support.microsoft.com/?kbid=971486&gt;: Security Update (Installed 01ca56402c1348ae by 'S-1-5-18')
KB972594 <http://support.microsoft.com/?kbid=972594&gt;: Security Update (Installed 01ca408d02e02de6 by 'S-1-5-18')
KB973525 <http://support.microsoft.com/?kbid=973525&gt;: Security Update (Installed 01ca56402c1348ae by 'S-1-5-18')
KB974455 <http://support.microsoft.com/?kbid=974455&gt;: Security Update (Installed 01ca56402c15aa0f by 'S-1-5-18')
KB974571 <http://support.microsoft.com/?kbid=974571&gt;: Security Update (Installed 01ca56402c15aa0f by 'S-1-5-18')
KB975467 <http://support.microsoft.com/?kbid=975467&gt;: Security Update (Installed 01ca56402c15aa0f by 'S-1-5-18')
KB975517 <http://support.microsoft.com/?kbid=975517&gt;: Security Update (Installed 01ca56402c180b70 by 'S-1-5-18')

Answer 1

http://blogs.msdn.com/oldnewthing/archive/2003/09/05/54806.aspx gives info on interpreting different types of time stamps. It looks like you have a Win32 FILETIME.

Answer 2

Installed <NTP TimeStamp> by '<Security Identifier>'

At the beginning of the string are NTP TimeStamps. You cant turn these into a System.DateTime very easily.

String s = "01c9d3cb9b46a87c";
DateTime dt = DateTime.FromFileTime(Int64.Parse(s, System.Globalization.NumberStyles.HexNumber));

For more information on NTP TimeStamps, read the RFC (don't worry, it's actually a "short" RFC) at: http://www.faqs.org/rfcs/rfc958.html

At the end of the string are security identifiers for accounts Local System is 'S-1-5-18'.

For more information on security identifiers, see: http://technet.microsoft.com/en-us/library/cc780850%28WS.10%29.aspx