# 4.4.7.1

# Features

- More telemetry for process creations and incidents
    
    
    - User SID
    - User down-level logon name
    - Whether or not the process is elevated (Run As Administrator)
- Incidents now report where iterative data access occurred

# Fixes

- Reduced memory usage during periods of server connectivity issues and heavy telemetry occurring at once
- Reduced memory usage during incident reporting

# MD5 Hashes

```
service.exe  = 0df0b7d76abd0978734ac961cd4cddaf
CCRRSecMon.sys (Windows7)        = dced5933e7b3e720a72160eb32cd83cb
CCRRSecMon.sys (Windows8)        = e14aa1324a9a42958cd955b9fffd4f79
CCRRSecMon.sys (Windows10)       = 9d2edcf2288e7563892dac6300517102
```