Posts tagged "srum"

• What is SRUM (SRUDB.dat)? (glossary)

  SRUM is the ESE database Windows uses to track per-application resource usage by hour over 30-60 days. The only Windows artefact with per-app network-byte totals. Critical for exfil.

  2026-05-24

• Amcache vs SRUM: presence vs long-window resource usage

  SRUM tracks per-app resource usage by hour over 30-60 days. Amcache inventories every PE on disk. They overlap on almost nothing and pair beautifully on exfil cases.

  2026-05-24