Stefan Siebert : ntdll: Implementation of process CreationTime and ExitTime .