hey lovely people, not sure if this is for #C0FHNQ2N6 or here: I am trying to map parent to child processes by name and due to the "recycling" of PIDs I have to match them by start time as well. In the process of doing that I found out that there are some entries that have multiple (in this case 2) distinct value for `start_time`:

timestamp_observed     start_time                       name                              process_id
2019-03-08 08:59:12	2019-03-08 08:58:55	SearchFilterHost.exe	13472	
2019-03-08 08:59:59	2019-03-08 08:58:55	SearchFilterHost.exe	13472	
2019-03-08 09:20:06	2019-03-08 09:19:59	SearchFilterHost.exe	13472	
2019-03-08 09:20:55	2019-03-08 09:19:59	SearchFilterHost.exe	13472	
2019-03-08 09:21:43	2019-03-08 09:19:59	SearchFilterHost.exe	13472

`timestamp_observed`: is the time at query as you can see PID is the same (and so is almost everything else).... Does any one knows the reason for this? And would it be reasonable to just assuming the lowest of the 2 values?