Different ProcessID field values ​​in sysmon event

View thread