THANK YOU! I was looking at the stack trace for my process' TCP Send event and was so confused why the stack initiated with an interrupt for a send, rather than the application code. Your explanation about this corresponding with the ACK, not the send call, now makes perfect sense!
My suspicion on why there is a time difference is that Wireshark 'sees' packets at a different level of the TCP/IP driver stack. I would expect it to be lower down, 'closer' to the wire than ProcMon. I don't know for certain, though, but that seems logical to me.
