4.4.7.1

Features

• More telemetry for process creations and incidents

  • User SID

  • User down-level logon name

  • Whether or not the process is elevated (Run As Administrator)

• Incidents now report where iterative data access occurred

Fixes

• Reduced memory usage during periods of server connectivity issues and heavy telemetry occurring at once

• Reduced memory usage during incident reporting

MD5 Hashes

service.exe  = 0df0b7d76abd0978734ac961cd4cddaf
CCRRSecMon.sys (Windows7)        = dced5933e7b3e720a72160eb32cd83cb
CCRRSecMon.sys (Windows8)        = e14aa1324a9a42958cd955b9fffd4f79
CCRRSecMon.sys (Windows10)       = 9d2edcf2288e7563892dac6300517102