fix(event): Invalid thread id for Map/Unmap view file events

These events don't contain the thread id parameter,
so trying to adjust the tid will always yield to an
invalid value.

Author: rabbitstack

pkg/kevent/kevent_windows.go

@@ -83,7 +83,10 @@ func (e *Kevent) adjustPID() {
 			e.PID, _ = e.Kparams.GetPid()
 		}
 	case ktypes.File:
-		e.Tid, _ = e.Kparams.GetTid()
+		if !e.IsMapViewFile() && !e.IsUnmapViewFile() {
+			// take thread id from the event parameters
+			e.Tid, _ = e.Kparams.GetTid()
+		}
 		switch {
 		case e.InvalidPid() && e.Type == ktypes.MapFileRundown:
 			// a valid pid for map rundown events