Structure of process GUIDs used in Sysmon ETW events

Question

Back in July 2018, Matt Graeber figured out the structure of the process GUID used in Sysmon events and published a PowerShell script to decode them. Since then however it seems that the structure has changed.

If mmmmmmmm-tttt-tttt-cccc-ccccwwwwwwww is a process GUID then:

mmmmmmmm - This is as Matt described, i.e. the upper 32 bits of the machine GUID.

tttt-tttt - This is also as Matt described, i.e. the process creation time expressed in seconds since the Unix epoch.

cccc-cccc - This seems to be just a monotonic counter of processes created since the Sysmon driver started.

wwwwwwww - I have no idea what this represents.

I think it would be very useful if Sysmon settled upon a final structure for process GUIDs and then published this. This would make it much easier for your customers to correlate events collected using Sysmon with events collected using other sources. Is there any possibility of such a standardisation happening?

Also, given that the PID and process creation time (PCT) are essentially unique per machine, why not just form the Sysmon process GUID by taking the 64 bits of the PCT, followed by the 32 bits of the PID, followed by the first 32 bits of the machine GUID?