Fix VMRay missing process data

[mr-tz]

closes #2394

Checklist

• No CHANGELOG update needed

• No new tests needed

• No documentation update needed

[williballenthin]

looks reasonable, i'll trust the tests.

[mike-hunhoff]

@mr-tz thanks for the initial fix. This made me realize that we should be using VMRay's thread and process monitor IDs instead of tid, pid, and ppid combinations as we can't guarantee these combinations are unique, e.g. reused ppid and pid combination, while it appears that the thread and process monitor IDs are unique, and thus combinations of these should be unique, e.g. for extracting function calls.

[mr-tz]

I ran this on a few random private analysis archives and didn't encounter any failures. We should find more public samples to add to the test corpus.

[williballenthin]

should we address #2361 (add fields to unique pid/ppid) here, while we're at it? or leave that for a PR immediately following this?

[mike-hunhoff]

should we address #2361 (add fields to unique pid/ppid) here, while we're at it? or leave that for a PR immediately following this?

We should address #2361 in a separate PR

[mr-tz]

Thanks for the additions, @mike-hunhoff!