_TCCSTART returns the time the current TCC session was started (UTC, as a FILETIME, in 100ns increments).