title: PID Creation Time
body: <p>I was looking for a way to figure out what time the PID was created/most-recently-claimed. I was able to get it with <code>NtQuerySystemInformation</code> however it seems intensive just to get the time a PID was claimed. Is there any very quick way to get this info?</p>
  
  <p>I tried <code>CreateToolhelp32Snapshot</code> -> <code>Process32First</code>, this way is very fast, but it doesn't give me the PID creation time.</p>
  
  <p>Thanks</p>
  
  <p>This is the info available to me from NtQuerySystemInformation is this structure below, it gives me <code>UniqueProcessId</code> and also <code>CreateTime</code></p>
  
  <p><a href="http://processhacker.sourceforge.net/doc/struct___s_y_s_t_e_m___p_r_o_c_e_s_s___i_n_f_o_r_m_a_t_i_o_n.html" rel="nofollow">http://processhacker.sourceforge.net/doc/struct___s_y_s_t_e_m___p_r_o_c_e_s_s___i_n_f_o_r_m_a_t_i_o_n.html</a></p>
  
  <p>_SYSTEM_PROCESS_INFORMATION Struct </p>
  
  <pre><code>ULONG   NextEntryOffset
  ULONG   NumberOfThreads
  LARGE_INTEGER   WorkingSetPrivateSize
  ULONG   HardFaultCount
  ULONG   NumberOfThreadsHighWatermark
  ULONGLONG   CycleTime
  LARGE_INTEGER   CreateTime
  LARGE_INTEGER   UserTime
  LARGE_INTEGER   KernelTime
  UNICODE_STRING  ImageName
  KPRIORITY   BasePriority
  HANDLE  UniqueProcessId
  HANDLE  InheritedFromUniqueProcessId
  ULONG   HandleCount
  ULONG   SessionId
  ULONG_PTR   UniqueProcessKey
  SIZE_T  PeakVirtualSize
  SIZE_T  VirtualSize
  ULONG   PageFaultCount
  SIZE_T  PeakWorkingSetSize
  SIZE_T  WorkingSetSize
  SIZE_T  QuotaPeakPagedPoolUsage
  SIZE_T  QuotaPagedPoolUsage
  SIZE_T  QuotaPeakNonPagedPoolUsage
  SIZE_T  QuotaNonPagedPoolUsage
  SIZE_T  PagefileUsage
  SIZE_T  PeakPagefileUsage
  SIZE_T  PrivatePageCount
  LARGE_INTEGER   ReadOperationCount
  LARGE_INTEGER   WriteOperationCount
  LARGE_INTEGER   OtherOperationCount
  LARGE_INTEGER   ReadTransferCount
  LARGE_INTEGER   WriteTransferCount
  LARGE_INTEGER   OtherTransferCount
  SYSTEM_THREAD_INFORMATION   Threads [1]
  </code></pre>