osquery isn’t doing process auditing on this host so I don’t have osquery data to compare it to besides what the query returned.