Current PE checksum   : 00014A49
Calculated PE checksum: 00014A49

签名索引: 0  (主签名)
消息摘要算法 : SHA1
当前消息摘要    : 893A44297C46442A76C85D32D3107DAF2F28C096
计算的消息摘要 : 893A44297C46442A76C85D32D3107DAF2F28C096

签名者证书:
	签名者 #0:
		主题: /C=AU/ST=South Australia/L=Adelaide/O=Click Studios (SA) Pty Ltd/CN=Click Studios (SA) Pty Ltd
		颁发者: /C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert SHA2 Assured ID Code Signing CA
		序列号: 0394517DACDC71187A40001B5CC32DE5
		证书过期日期:
			不早于 : Oct 26 00:00:00 2020 GMT
			不晚于 : Dec 12 23:59:59 2023 GMT
...

DeviceFileCertificateInfo
| where CertificateSerialNumber == "0394517dacdc71187a40001b5cc32de5"
| join DeviceFileEvents on SHA1
| sort by Timestamp
| project Timestamp, DeviceName, FolderPath, SHA256, InitiatingProcessAccountName