Posts tagged "execution-evidence"

• What is SRUM (SRUDB.dat)? (glossary)

  SRUM is the ESE database Windows uses to track per-application resource usage by hour over 30-60 days. The only Windows artefact with per-app network-byte totals. Critical for exfil.

  2026-05-24

• What is Windows Prefetch? (glossary)

  Windows Prefetch is the directory of .pf files that proves execution. Up to 8-10 run times per binary plus the files loaded in the first ten seconds. The strongest Windows execution evidence.

  2026-05-24