For me it is the security cookie created for each process to prevent buffer-overflow attacks. Tracking its creation with a debugger, it's created by xoring the Thread ID, the Process ID, the PerformanceCount the TickCount and more... And then if by any chance the most word is zero, then the least word is copied into it... For me it is the security cookie created for ea