That is a value that KeQuerySystemTime returns, and is stored in `CreateTime`

of `EPROCESS`

.

System time is a count of 100-nanosecond intervals since January 1, 1601.

NirSoft provides us with a look into the struct, it's the third property there; a large integer of 64-bit. Meaning it has an upper and a lower part which each are a 32-bit integer. Let's combine those...

`01ccfe1e`

unsigned corresponds to `30211614`

, `3e206d42`

unsigned corresponds to `1042312514`

.

Now, it's a matter of multiplying the earlier by `4,294,967,296`

(+1) and adding the other value to it:

```
30211614 * 4294967296 + 1042312514 = 129757895131688258
```

We multiply by that value because it is the the amount of possible values of an unsigned 32-bit integer.

And we can verify our result with Wolfram Alpha (Thanks iglvzx); so, multiplied by 100 that gives us:

```
12975789513168825800 nanoseconds
```

And once we have these nanoseconds it's just some Wolfram Alpha magic, giving approximately:

```
411 years, 5 months, 15 days, 15 hours, 58 minutes, 33.17 seconds
```

Again using Wolfram Alpha magic we compute the correct date (thnx again) and then add the time to it:

```
6/16/2012; 15:58:33 GMT
```

Which tells me there is something odd going on with your computer's clock...

**Extra:** The last can also be done with Powershell, sadly it doesn't support large millisecond values:

```
PS C:> (new-object DateTime(1601,1,1,0,0,0,0)).AddYears(411).AddMonths(5).AddDays(15).AddHours(15).AddMinutes(58).AddSeconds(33)
Saturday, June 16, 2012 3:58:33 PM
```