SRUM Extensions (Table GUIDs)

Names the tables in the SRUM database, so you know what each GUID table holds.

Use it to name the tables in the SRUM database, so you can read per-app resource use and network traffic.

SOFTWARE
System Information

What It Is

SRUM, the System Resource Usage Monitor, records how much each program used the processor, the disk and the network, and this key names the tables in the SRUM database so you know what each one holds. Read it as the map to SRUDB.dat, which holds per-app resource use and network bytes. The key itself holds no usage data. It lives in SOFTWARE.

What It Proves

Which SRUM providers this machine runs, and so which tables SRUDB.dat holds, covering app resource use, network bytes, network connections, energy and notifications.

What It Does Not Prove

The key holds no usage data, which is in C:\Windows\System32\sru\SRUDB.dat. SRUM keeps roughly the last month and writes about once an hour, so the newest activity may not be in the file yet.

Where It Lives

SRUM Extensions (Table GUIDs) lives in the SOFTWARE hive, which holds settings for the whole machine. Offline Hive shows the path inside the hive file, as Registry Explorer opens it, and Live System shows the same key as regedit shows it on a running machine. The line under the path is where the hive file sits on disk.

SOFTWARE\Microsoft\Windows NT\CurrentVersion\SRUM\Extensions\<GUID>

C:\Windows\System32\config\SOFTWARE

What It Looks Like

These are three values from this key on ws-042, the fictional machine the wiki follows, decoded into plain English. Each row shows the value as Windows stores it, its name, type and data, then what it tells you.

Values in SRUM Extensions (Table GUIDs), each with what it tells you
Registry Value	What It Tells You
`{973F5D5C-1D90-4944-BE8E-24B94231A174}` `Subkeynduprov.dll`	This GUID is the network data usage table, the bytes each app sent and received per network. Check it for bytes sent by WinSCP.exe on 15 Oct.
`{D10CA2FE-6FCF-4F6D-848E-B2E99266FA89}` `Subkeyappsruprov.dll`	This GUID is the application resource usage table, the processor time and bytes read and written per app. It can show procdump64.exe ran even with the stick gone.
`{DD6636C4-8929-4683-974E-22C046A43763}` `Subkeyncuprov.dll`	This GUID is the network connectivity table, which network each interface used and for how long. Its L2ProfileId names the hotel Wi-Fi through WlanSvc.

How to Read It

Each GUID subkey is a provider, backed by a DLL such as nduprov.dll for network data usage. The table with the same GUID in SRUDB.dat holds that provider's data. Parse SRUDB.dat with SrumECmd and give it the SOFTWARE hive as well, so it can resolve more names.

When Windows Writes It: When Windows registers a SRUM provider, usually at install or a feature update.
Which Windows Versions: Windows 8 to 11
Tools That Parse It: SrumECmd, Registry Explorer, srum-dump

Hunt It

This key only names the tables, so the usage comes from SRUDB.dat, which you parse offline with a SRUM tool. EDR process and network data corroborate what SRUM shows.

Cannot See ItSRUDB.dat and SOFTWARE hive, parsed offline

Defender does not read SRUM. Collect SRUDB.dat with the SOFTWARE hive and parse them with SrumECmd.

Parse the Hive Instead

Collect: C:\Windows\System32\config\SOFTWARE
Parse With: SrumECmdRegistry Explorersrum-dump

Confirm It With

One artefact can mislead on its own. These other records show the same activity, or pin down when it happened, so use them to back up what SRUM Extensions (Table GUIDs) shows.

Wi-Fi Profiles (WlanSvc)Turns the L2ProfileId in SRUM's network tables into a network name.
The SRUM Database, C:\Windows\System32\sru\SRUDB.datNot in the RegistryIt holds the usage data these GUIDs name, each program's resource use and network bytes.

Sources

The facts on this page come from these public pages, which say more on each point.