<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>Memory Forensics &#8211; Cerbero Blog</title>
	<atom:link href="https://blog.cerbero.io/tag/memory-forensics/feed/" rel="self" type="application/rss+xml" />
	<link>https://blog.cerbero.io</link>
	<description></description>
	<lastBuildDate>Thu, 12 Mar 2026 11:49:30 +0000</lastBuildDate>
	<language>en-US</language>
	<sy:updatePeriod>
	hourly	</sy:updatePeriod>
	<sy:updateFrequency>
	1	</sy:updateFrequency>
	<generator>https://wordpress.org/?v=6.9.4</generator>

<image>
	<url>https://blog.cerbero.io/wp-content/uploads/2023/09/cropped-pro_icon_512-32x32.png</url>
	<title>Memory Forensics &#8211; Cerbero Blog</title>
	<link>https://blog.cerbero.io</link>
	<width>32</width>
	<height>32</height>
</image> 
<site xmlns="com-wordpress:feed-additions:1">184292133</site>	<item>
		<title>Memory Challenge 18: Reminiscent</title>
		<link>https://blog.cerbero.io/memory-challenge-18-reminiscent/</link>
					<comments>https://blog.cerbero.io/memory-challenge-18-reminiscent/#respond</comments>
		
		<dc:creator><![CDATA[Erik Pistelli]]></dc:creator>
		<pubDate>Thu, 12 Mar 2026 11:49:30 +0000</pubDate>
				<category><![CDATA[Video]]></category>
		<category><![CDATA[Challenge]]></category>
		<category><![CDATA[Memory Forensics]]></category>
		<category><![CDATA[windows]]></category>
		<guid isPermaLink="false">https://blog.cerbero.io/?p=3346</guid>

					<description><![CDATA[We&#8217;re testing our Memory Analysis package (currently in beta) against various challenges available online. We found this challenge on Hack The Box, so credit goes to them for creating it. The scenario is as follows: &#8220;Suspicious traffic was detected from a recruiter&#8217;s virtual PC. A memory dump of the offending VM was captured before it &#8230; <a href="https://blog.cerbero.io/memory-challenge-18-reminiscent/" class="more-link">Continue reading<span class="screen-reader-text"> "Memory Challenge 18: Reminiscent"</span></a>]]></description>
		
					<wfw:commentRss>https://blog.cerbero.io/memory-challenge-18-reminiscent/feed/</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
		<post-id xmlns="com-wordpress:feed-additions:1">3346</post-id>	</item>
		<item>
		<title>Memory Challenge 17: Recollection</title>
		<link>https://blog.cerbero.io/memory-challenge-17-recollection/</link>
					<comments>https://blog.cerbero.io/memory-challenge-17-recollection/#respond</comments>
		
		<dc:creator><![CDATA[Erik Pistelli]]></dc:creator>
		<pubDate>Mon, 23 Feb 2026 11:35:08 +0000</pubDate>
				<category><![CDATA[Video]]></category>
		<category><![CDATA[Challenge]]></category>
		<category><![CDATA[Memory Forensics]]></category>
		<category><![CDATA[windows]]></category>
		<guid isPermaLink="false">https://blog.cerbero.io/?p=3342</guid>

					<description><![CDATA[We&#8217;re testing our Memory Analysis package (currently in beta) against various challenges available online. We found this challenge on the Memory Forensic site, so credit goes to them for highlighting it and to Hack The Box for creating it in the first place. The scenario is as follows: &#8220;A junior member of our security team &#8230; <a href="https://blog.cerbero.io/memory-challenge-17-recollection/" class="more-link">Continue reading<span class="screen-reader-text"> "Memory Challenge 17: Recollection"</span></a>]]></description>
		
					<wfw:commentRss>https://blog.cerbero.io/memory-challenge-17-recollection/feed/</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
		<post-id xmlns="com-wordpress:feed-additions:1">3342</post-id>	</item>
		<item>
		<title>Memory Analysis Package 0.9</title>
		<link>https://blog.cerbero.io/memory-analysis-package-0-9/</link>
					<comments>https://blog.cerbero.io/memory-analysis-package-0-9/#respond</comments>
		
		<dc:creator><![CDATA[Erik Pistelli]]></dc:creator>
		<pubDate>Wed, 18 Feb 2026 10:32:48 +0000</pubDate>
				<category><![CDATA[Package]]></category>
		<category><![CDATA[Clipboard]]></category>
		<category><![CDATA[GUI]]></category>
		<category><![CDATA[Memory Forensics]]></category>
		<category><![CDATA[windows]]></category>
		<guid isPermaLink="false">https://blog.cerbero.io/?p=3333</guid>

					<description><![CDATA[We are excited to announce the release of Memory Analysis 0.9 package, a significant milestone that introduces support for extracting GUI artifacts. Windows Clipboard All features have been thoroughly tested across Windows versions from XP through Windows 11, on both x86 and x64 architectures. This, for instance, is the latest version of Windows 11. Windows &#8230; <a href="https://blog.cerbero.io/memory-analysis-package-0-9/" class="more-link">Continue reading<span class="screen-reader-text"> "Memory Analysis Package 0.9"</span></a>]]></description>
		
					<wfw:commentRss>https://blog.cerbero.io/memory-analysis-package-0-9/feed/</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
		<post-id xmlns="com-wordpress:feed-additions:1">3333</post-id>	</item>
		<item>
		<title>Memory Challenge 16: MemLabs Lab 1 &#8211; Beginner’s Luck</title>
		<link>https://blog.cerbero.io/memory-challenge-16-memlabs-lab-1-beginners-luck/</link>
					<comments>https://blog.cerbero.io/memory-challenge-16-memlabs-lab-1-beginners-luck/#respond</comments>
		
		<dc:creator><![CDATA[Erik Pistelli]]></dc:creator>
		<pubDate>Mon, 02 Feb 2026 12:12:21 +0000</pubDate>
				<category><![CDATA[Video]]></category>
		<category><![CDATA[Challenge]]></category>
		<category><![CDATA[Memory Forensics]]></category>
		<category><![CDATA[windows]]></category>
		<guid isPermaLink="false">https://blog.cerbero.io/?p=3328</guid>

					<description><![CDATA[We&#8217;re testing our Memory Analysis package (currently in beta) against various challenges available online. We found this challenge on the Memory Forensic site, so credit goes to them for highlighting it and to MemLabs for creating it in the first place. The description is as follows: &#8220;My sister&#8217;s computer crashed. We were very fortunate to &#8230; <a href="https://blog.cerbero.io/memory-challenge-16-memlabs-lab-1-beginners-luck/" class="more-link">Continue reading<span class="screen-reader-text"> "Memory Challenge 16: MemLabs Lab 1 &#8211; Beginner’s Luck"</span></a>]]></description>
		
					<wfw:commentRss>https://blog.cerbero.io/memory-challenge-16-memlabs-lab-1-beginners-luck/feed/</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
		<post-id xmlns="com-wordpress:feed-additions:1">3328</post-id>	</item>
		<item>
		<title>Memory Analysis Package 0.8</title>
		<link>https://blog.cerbero.io/memory-analysis-package-0-8/</link>
					<comments>https://blog.cerbero.io/memory-analysis-package-0-8/#respond</comments>
		
		<dc:creator><![CDATA[Erik Pistelli]]></dc:creator>
		<pubDate>Mon, 26 Jan 2026 11:39:56 +0000</pubDate>
				<category><![CDATA[Package]]></category>
		<category><![CDATA[Callbacks]]></category>
		<category><![CDATA[Console]]></category>
		<category><![CDATA[Memory Forensics]]></category>
		<category><![CDATA[Shell]]></category>
		<category><![CDATA[Terminal]]></category>
		<guid isPermaLink="false">https://blog.cerbero.io/?p=3316</guid>

					<description><![CDATA[We are excited to announce the release of the Memory Analysis 0.8 package. The main feature of this version is the introduction of console information extraction. Consoles Kernel Callbacks Consoles Extracting console information is a valuable capability for forensics, malware analysis, and CTF challenges. Our initial implementation supports the following systems: Windows XP (x86/x64, all &#8230; <a href="https://blog.cerbero.io/memory-analysis-package-0-8/" class="more-link">Continue reading<span class="screen-reader-text"> "Memory Analysis Package 0.8"</span></a>]]></description>
		
					<wfw:commentRss>https://blog.cerbero.io/memory-analysis-package-0-8/feed/</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
		<post-id xmlns="com-wordpress:feed-additions:1">3316</post-id>	</item>
		<item>
		<title>Memory Challenge 15: Hijacked</title>
		<link>https://blog.cerbero.io/memory-challenge-15-hijacked/</link>
					<comments>https://blog.cerbero.io/memory-challenge-15-hijacked/#respond</comments>
		
		<dc:creator><![CDATA[Erik Pistelli]]></dc:creator>
		<pubDate>Mon, 12 Jan 2026 11:48:10 +0000</pubDate>
				<category><![CDATA[Video]]></category>
		<category><![CDATA[Challenge]]></category>
		<category><![CDATA[Memory Forensics]]></category>
		<category><![CDATA[windows]]></category>
		<guid isPermaLink="false">https://blog.cerbero.io/?p=3300</guid>

					<description><![CDATA[We&#8217;re testing our Memory Analysis package (currently in beta) against various challenges available online. We found this challenge on Hack The Box, so credit goes to them for creating it. The scenario is as follows: &#8220;Happy Grunwald, the CEO of Forela, decided to expand the company&#8217;s business in Lahore, Pakistan, and brought along his IT &#8230; <a href="https://blog.cerbero.io/memory-challenge-15-hijacked/" class="more-link">Continue reading<span class="screen-reader-text"> "Memory Challenge 15: Hijacked"</span></a>]]></description>
		
					<wfw:commentRss>https://blog.cerbero.io/memory-challenge-15-hijacked/feed/</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
		<post-id xmlns="com-wordpress:feed-additions:1">3300</post-id>	</item>
		<item>
		<title>Memory Challenge 14: RogueOne</title>
		<link>https://blog.cerbero.io/memory-challenge-14-rogueone/</link>
					<comments>https://blog.cerbero.io/memory-challenge-14-rogueone/#respond</comments>
		
		<dc:creator><![CDATA[Erik Pistelli]]></dc:creator>
		<pubDate>Thu, 18 Dec 2025 12:21:09 +0000</pubDate>
				<category><![CDATA[Video]]></category>
		<category><![CDATA[Challenge]]></category>
		<category><![CDATA[Memory Forensics]]></category>
		<category><![CDATA[windows]]></category>
		<guid isPermaLink="false">https://blog.cerbero.io/?p=3298</guid>

					<description><![CDATA[We&#8217;re testing our Memory Analysis package (currently in beta) against various challenges available online. We found this challenge on the Memory Forensic site, so credit goes to them for highlighting it and to Hack The Box for creating it in the first place. The scenario is as follows: &#8220;Your SIEM system generated multiple alerts in &#8230; <a href="https://blog.cerbero.io/memory-challenge-14-rogueone/" class="more-link">Continue reading<span class="screen-reader-text"> "Memory Challenge 14: RogueOne"</span></a>]]></description>
		
					<wfw:commentRss>https://blog.cerbero.io/memory-challenge-14-rogueone/feed/</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
		<post-id xmlns="com-wordpress:feed-additions:1">3298</post-id>	</item>
		<item>
		<title>Memory Challenge 13: TeamSpy</title>
		<link>https://blog.cerbero.io/memory-challenge-13-teamspy/</link>
					<comments>https://blog.cerbero.io/memory-challenge-13-teamspy/#respond</comments>
		
		<dc:creator><![CDATA[Erik Pistelli]]></dc:creator>
		<pubDate>Tue, 16 Dec 2025 11:39:06 +0000</pubDate>
				<category><![CDATA[Video]]></category>
		<category><![CDATA[Challenge]]></category>
		<category><![CDATA[Memory Forensics]]></category>
		<category><![CDATA[windows]]></category>
		<guid isPermaLink="false">https://blog.cerbero.io/?p=3290</guid>

					<description><![CDATA[We&#8217;re testing our Memory Analysis package (currently in beta) against various challenges available online. We found this challenge on the Memory Forensic site, so credit goes to them for highlighting it and to CyberDefenders for creating it in the first place. The scenario is as follows: &#8220;An employee reported that his machine started to act &#8230; <a href="https://blog.cerbero.io/memory-challenge-13-teamspy/" class="more-link">Continue reading<span class="screen-reader-text"> "Memory Challenge 13: TeamSpy"</span></a>]]></description>
		
					<wfw:commentRss>https://blog.cerbero.io/memory-challenge-13-teamspy/feed/</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
		<post-id xmlns="com-wordpress:feed-additions:1">3290</post-id>	</item>
		<item>
		<title>Memory Challenge 12: BlackEnergy</title>
		<link>https://blog.cerbero.io/memory-challenge-12-blackenergy/</link>
					<comments>https://blog.cerbero.io/memory-challenge-12-blackenergy/#respond</comments>
		
		<dc:creator><![CDATA[Erik Pistelli]]></dc:creator>
		<pubDate>Thu, 11 Dec 2025 11:52:56 +0000</pubDate>
				<category><![CDATA[Video]]></category>
		<category><![CDATA[Challenge]]></category>
		<category><![CDATA[Memory Forensics]]></category>
		<category><![CDATA[windows]]></category>
		<guid isPermaLink="false">https://blog.cerbero.io/?p=3286</guid>

					<description><![CDATA[We&#8217;re testing our Memory Analysis package (currently in beta) against various challenges available online. We found this challenge on the Memory Forensic site, so credit goes to them for highlighting it and to CyberDefenders for creating it in the first place. The scenario is as follows: &#8220;A multinational corporation has been hit by a cyber &#8230; <a href="https://blog.cerbero.io/memory-challenge-12-blackenergy/" class="more-link">Continue reading<span class="screen-reader-text"> "Memory Challenge 12: BlackEnergy"</span></a>]]></description>
		
					<wfw:commentRss>https://blog.cerbero.io/memory-challenge-12-blackenergy/feed/</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
		<post-id xmlns="com-wordpress:feed-additions:1">3286</post-id>	</item>
		<item>
		<title>Memory Challenge 11: BOughT</title>
		<link>https://blog.cerbero.io/memory-challenge-11-bought/</link>
					<comments>https://blog.cerbero.io/memory-challenge-11-bought/#respond</comments>
		
		<dc:creator><![CDATA[Erik Pistelli]]></dc:creator>
		<pubDate>Mon, 08 Dec 2025 14:06:05 +0000</pubDate>
				<category><![CDATA[Video]]></category>
		<category><![CDATA[Challenge]]></category>
		<category><![CDATA[Memory Forensics]]></category>
		<category><![CDATA[windows]]></category>
		<guid isPermaLink="false">https://blog.cerbero.io/?p=3277</guid>

					<description><![CDATA[We&#8217;re testing our Memory Analysis package (currently in beta) against various challenges available online. We found this challenge on Hack The Box, so credit goes to them for creating it. The scenario is as follows: &#8220;A non-technical client recently purchased a used computer for personal use from a stranger they encountered online. Since acquiring the &#8230; <a href="https://blog.cerbero.io/memory-challenge-11-bought/" class="more-link">Continue reading<span class="screen-reader-text"> "Memory Challenge 11: BOughT"</span></a>]]></description>
		
					<wfw:commentRss>https://blog.cerbero.io/memory-challenge-11-bought/feed/</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
		<post-id xmlns="com-wordpress:feed-additions:1">3277</post-id>	</item>
	</channel>
</rss>
