hemu1438/forensicsgpt-training-data huggingface dataset:
Memory Samples · volatilityfoundation/volatility Wiki · GitHub
This is a list of publicly available memory samples for testing purposes.
Description OS 
Art of Memory Forensics Images	Assorted Windows, Linux, and Mac	
Mac OSX 10.8.3 x64	Mac Mountain Lion 10.8.3 x64	
Jackcr's forensic challenge	Windows XP x86 and Windows 2003 SP0 x86 (4 images)	
GrrCon forensic challenge ISO (also see PDF questions)	Windows XP x86	
Malware Cookbook DVD	Black Energy, CoreFlood, Laqma, Prolaco, Sality, Silent Banker, Tigger, Zeus, etc	
Malware - Cridex	Windows XP SP2 x86	
Malware - Shylock	Windows XP SP3 x86	
Malware - R2D2 (pw: infected)	Windows XP SP2 x86	
Windows 7 x64	Windows 7 SP1 x64	
NIST (5 samples)	Windows XP SP2, 2003 SP0, and Vista Beta 2 (all x86)	
Hogfly's skydrive (13 samples)	Assorted (mostly Windows XP x86)	
Moyix's Fuzzy Hidden Process Sample	Windows XP SP3 x86	
Honeynet Banking Troubles Image	Windows XP SP2 x86	
NPS 2009-M57 (~70 samples)	Various XP / Vista x86	
Dougee's comparison samples	WIndows XP x86	
DFRWS 2008 Forensic Challenge	CentOS	
Honeynet Compromised Server Challenge	Linux Debian 2.6.26-26 x86	
Pikeworks Linux Samples	Linux CentOS and Ubuntu (x86/x64)	
DFRWS 2011 Forensics Challenge	Android	
DFRWS 2012 Rodeo	Android
History for Memory Samples · volatilityfoundation/volatility Wiki · GitHub
This repository was archived by the owner on May 16, 2025. It is now read-only. 
Updated Memory Samples (markdown) 
gleeda committed 
Mar 22, 2019Mar 22, 2019 
Updated Memory Samples (markdown) 
iMHLv2 committed 
Jun 29, 2017Jun 29, 2017 
Updated Memory Samples (markdown) 
iMHLv2 committed 
Jun 29, 2017Jun 29, 2017 
Updated Memory Samples (markdown) 
iMHLv2 committed 
Jun 29, 2017Jun 29, 2017 
Updated Memory Samples (markdown) 
iMHLv2 committed 
Jan 7, 2017Jan 7, 2017 
Updated Memory Samples (markdown) 
gleeda committed 
Jan 23, 2016Jan 23, 2016 
Updated Memory Samples (markdown) 
iMHLv2 committed 
Aug 1, 2014Aug 1, 2014 
initial commit of converted wikis 
gleeda committed 
Apr 24, 2014Apr 24, 2014
make minor changes · stuxnet999/MemLabs@79ad019 · GitHub
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ We received this memory dump from our client recently. Someone accessed his syst
	
8	8		
9	9	
Also, he noticed his most loved application that he always used crashed every time he ran it. Was it a virus?
	
10	10		
11		-
**Note-1**: This challenge is composed of 3 flags.
	
	11	+
**Note-1**: This challenge is composed of 3 flags. If you think 2nd flag is the end, it isn't!! :P
	
12	12		
13	13	
**Note-2**: There was a small mistake when making this challenge. If you find any string which has the string "**_L4B_3_D0n3_!!**" in it, please change it to "**_L4B_5_D0n3_!!**" and then proceed.
	
14	14		
@@ -24,4 +24,4 @@ The commpressed archive
	
24	24	
The memory dump
	
25	25	
+ MD5 hash: 9dd6cb1134c9b018020bad44f27394db
	
26	26		
27		-
Please follow the [flag submission rules](https://github.com/stuxnet999/MemLabs#flag-submission) when sending the email for solution verification.
	
	27	+
Please follow the [flag submission rules](https://github.com/stuxnet999/MemLabs#flag-submission) when sending the email for solution verification.
Initial commit · stuxnet999/MemLabs@84a38dd · GitHub
@@ -0,0 +1,21 @@
1+
MIT License
2+3+
Copyright (c) 2019 P. Abhiram Kumar
4+5+
Permission is hereby granted, free of charge, to any person obtaining a copy
6+
of this software and associated documentation files (the "Software"), to deal
7+
in the Software without restriction, including without limitation the rights
8+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9+
copies of the Software, and to permit persons to whom the Software is
10+
furnished to do so, subject to the following conditions:
11+12+
The above copyright notice and this permission notice shall be included in all
13+
copies or substantial portions of the Software.
14+15+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21+
SOFTWARE.
MemLabs/Lab 6 at master · stuxnet999/MemLabs · GitHub
We received this memory dump from the Intelligence Bureau Department. They say this evidence might hold some secrets of the underworld gangster David Benjamin. This memory dump was taken from one of his workers whom the FBI busted earlier this week. Your job is to go through the memory dump and see if you can figure something out. FBI also says that David communicated with his workers via the internet so that might be a good place to start.
Note: This challenge is composed of 1 flag split into 2 parts.
The flag format for this lab is: inctf{s0me_l33t_Str1ng}
Challenge file: MemLabs_Lab6
The commpressed archive
MD5 hash: e657a2aec85a66dafa828cde25528116
The memory dump
MD5 hash: 405985dc8ab7651c65cdbc04cb22961c
Please follow the flag submission rules when sending the email for solution verification.
Update logo. Change red to blue · stuxnet999/MemLabs@a4caf81 · GitHub
Commit a4caf81
committed
Mar 8, 2021Mar 8, 2021
Update logo. Change red to blue
2 files changed
File tree
Images
-71.4 KB
Binary file not shown.
9.75 KB
Deleted 
W: 1px | H: 1px 
Added 
W: 1px | H: 1px 
Rendered with ❤ by GitHub 
0 commit comments
Comments
(0)
MemLabs/Lab 5 at master · stuxnet999/MemLabs · GitHub
We received this memory dump from our client recently. Someone accessed his system when he was not there and he found some rather strange files being accessed. Find those files and they might be useful. I quote his exact statement,
The names were not readable. They were composed of alphabets and numbers but I wasn't able to make out what exactly it was.
Also, he noticed his most loved application that he always used crashed every time he ran it. Was it a virus?
Note-1: This challenge is composed of 3 flags. If you think 2nd flag is the end, it isn't!! :P
Note-2: There was a small mistake when making this challenge. If you find any string which has the string "L4B_3_D0n3!!" in it, please change it to "L4B_5_D0n3!!" and then proceed.
Note-3: You'll get the stage 2 flag only when you have the stage 1 flag.
Challenge file: MemLabs_Lab5
The commpressed archive
MD5 hash: d72a2141baa6670d46c77b5f452f09f7
The memory dump
MD5 hash: 9dd6cb1134c9b018020bad44f27394db
Please follow the flag submission rules when sending the email for solution verification.
Memory Samples · volatilityfoundation/volatility Wiki · GitHub
This is a list of publicly available memory samples for testing purposes.
Description OS 
Art of Memory Forensics Images	Assorted Windows, Linux, and Mac	
Mac OSX 10.8.3 x64	Mac Mountain Lion 10.8.3 x64	
Jackcr's forensic challenge	Windows XP x86 and Windows 2003 SP0 x86 (4 images)	
GrrCon forensic challenge ISO (also see PDF questions)	Windows XP x86	
[Malware Cookbook DVD] (https://www.sendspace.com/pro/dl/p87m18)	Black Energy, CoreFlood, Laqma, Prolaco, Sality, Silent Banker, Tigger, Zeus, etc	
Malware - Cridex	Windows XP SP2 x86	
Malware - Shylock	Windows XP SP3 x86	
Malware - R2D2 (pw: infected)	Windows XP SP2 x86	
Windows 7 x64	Windows 7 SP1 x64	
NIST (5 samples)	Windows XP SP2, 2003 SP0, and Vista Beta 2 (all x86)	
Hogfly's skydrive (13 samples)	Assorted (mostly Windows XP x86)	
Moyix's Fuzzy Hidden Process Sample	Windows XP SP3 x86	
Honeynet Banking Troubles Image	Windows XP SP2 x86	
NPS 2009-M57 (~70 samples)	Various XP / Vista x86	
Dougee's comparison samples	WIndows XP x86	
DFRWS 2008 Forensic Challenge	CentOS	
Honeynet Compromised Server Challenge	Linux Debian 2.6.26-26 x86	
Pikeworks Linux Samples	Linux CentOS and Ubuntu (x86/x64)	
DFRWS 2011 Forensics Challenge	Android	
DFRWS 2012 Rodeo	Android
Memory Samples · volatilityfoundation/volatility Wiki · GitHub
This is a list of publicly available memory samples for testing purposes.
Description OS 
Art of Memory Forensics Images	Assorted Windows, Linux, and Mac	
Mac OSX 10.8.3 x64	Mac Mountain Lion 10.8.3 x64	
Jackcr's forensic challenge	Windows XP x86 and Windows 2003 SP0 x86 (4 images)	
GrrCon forensic challenge ISO (also see PDF questions)	Windows XP x86	
[Malware Cookbook DVD (https://www.sendspace.com/pro/dl/p87m18)]	Black Energy, CoreFlood, Laqma, Prolaco, Sality, Silent Banker, Tigger, Zeus, etc	
Malware - Cridex	Windows XP SP2 x86	
Malware - Shylock	Windows XP SP3 x86	
Malware - R2D2 (pw: infected)	Windows XP SP2 x86	
Windows 7 x64	Windows 7 SP1 x64	
NIST (5 samples)	Windows XP SP2, 2003 SP0, and Vista Beta 2 (all x86)	
Hogfly's skydrive (13 samples)	Assorted (mostly Windows XP x86)	
Moyix's Fuzzy Hidden Process Sample	Windows XP SP3 x86	
Honeynet Banking Troubles Image	Windows XP SP2 x86	
NPS 2009-M57 (~70 samples)	Various XP / Vista x86	
Dougee's comparison samples	WIndows XP x86	
DFRWS 2008 Forensic Challenge	CentOS	
Honeynet Compromised Server Challenge	Linux Debian 2.6.26-26 x86	
Pikeworks Linux Samples	Linux CentOS and Ubuntu (x86/x64)	
DFRWS 2011 Forensics Challenge	Android	
DFRWS 2012 Rodeo	Android
Memory Samples · volatilityfoundation/volatility Wiki · GitHub
This is a list of publicly available memory samples for testing purposes.
Description OS 
Art of Memory Forensics Images	Assorted Windows, Linux, and Mac	
Mac OSX 10.8.3 x64	Mac Mountain Lion 10.8.3 x64	
Jackcr's forensic challenge	Windows XP x86 and Windows 2003 SP0 x86 (4 images)	
GrrCon forensic challenge ISO (also see PDF questions)	Windows XP x86	
[Malware Cookbook DVD (https://www.sendspace.com/pro/dl/p87m18)	Black Energy, CoreFlood, Laqma, Prolaco, Sality, Silent Banker, Tigger, Zeus, etc	
Malware - Cridex	Windows XP SP2 x86	
Malware - Shylock	Windows XP SP3 x86	
Malware - R2D2 (pw: infected)	Windows XP SP2 x86	
Windows 7 x64	Windows 7 SP1 x64	
NIST (5 samples)	Windows XP SP2, 2003 SP0, and Vista Beta 2 (all x86)	
Hogfly's skydrive (13 samples)	Assorted (mostly Windows XP x86)	
Moyix's Fuzzy Hidden Process Sample	Windows XP SP3 x86	
Honeynet Banking Troubles Image	Windows XP SP2 x86	
NPS 2009-M57 (~70 samples)	Various XP / Vista x86	
Dougee's comparison samples	WIndows XP x86	
DFRWS 2008 Forensic Challenge	CentOS	
Honeynet Compromised Server Challenge	Linux Debian 2.6.26-26 x86	
Pikeworks Linux Samples	Linux CentOS and Ubuntu (x86/x64)	
DFRWS 2011 Forensics Challenge	Android	
DFRWS 2012 Rodeo	Android
Memory Samples · volatilityfoundation/volatility Wiki · GitHub
This is a list of publicly available memory samples for testing purposes.
Description OS 
Art of Memory Forensics Images	Assorted Windows, Linux, and Mac	
Mac OSX 10.8.3 x64	Mac Mountain Lion 10.8.3 x64	
Jackcr's forensic challenge	Windows XP x86 and Windows 2003 SP0 x86 (4 images)	
GrrCon forensic challenge ISO (also see PDF questions)	Windows XP x86	
Malware - BlackEnergy	Windows XP SP2 x86	
Malware- CoreFlood	Windows XP SP2 x86	
Malware - Laqma	Windows XP SP2 x86	
Malware - Prolaco	Windows XP SP2 x86	
Malware - Sality	Windows XP SP2 x86	
Malware - Silentbanker	Windows XP SP2 x86	
Malware - Tigger	Windows XP SP2 x86	
Malware - Zeus	Windows XP SP2 x86	
Malware - SpyEye	Windows XP SP2 x86	
Malware - Stuxnet	Windows XP SP3 x86	
Malware - Cridex	Windows XP SP2 x86	
Malware - Shylock	Windows XP SP3 x86	
Malware - R2D2 (pw: infected)	Windows XP SP2 x86	
Windows 7 x64	Windows 7 SP1 x64	
NIST (5 samples)	Windows XP SP2, 2003 SP0, and Vista Beta 2 (all x86)	
Hogfly's skydrive (13 samples)	Assorted (mostly Windows XP x86)	
Moyix's Fuzzy Hidden Process Sample	Windows XP SP3 x86	
Honeynet Banking Troubles Image	Windows XP SP2 x86	
NPS 2009-M57 (~70 samples)	Various XP / Vista x86	
Dougee's comparison samples	WIndows XP x86	
DFRWS 2008 Forensic Challenge	CentOS	
Honeynet Compromised Server Challenge	Linux Debian 2.6.26-26 x86	
Pikeworks Linux Samples	Linux CentOS and Ubuntu (x86/x64)	
DFRWS 2011 Forensics Challenge	Android	
DFRWS 2012 Rodeo	Android
Memory Samples · volatilityfoundation/volatility Wiki · GitHub
This is a list of publicly available memory samples for testing purposes.
Description OS 
Art of Memory Forensics Images	Assorted Windows, Linux, and Mac	
Mac OSX 10.8.3 x64	Mac Mountain Lion 10.8.3 x64	
Jackcr's forensic challenge	Windows XP x86 and Windows 2003 SP0 x86 (4 images)	
GrrCon forensic challenge ISO (also see PDF questions)	Windows XP x86	
Malware - BlackEnergy	Windows XP SP2 x86	
Malware- CoreFlood	Windows XP SP2 x86	
Malware - Laqma	Windows XP SP2 x86	
Malware - Prolaco	Windows XP SP2 x86	
Malware - Sality	Windows XP SP2 x86	
Malware - Silentbanker	Windows XP SP2 x86	
Malware - Tigger	Windows XP SP2 x86	
Malware - Zeus	Windows XP SP2 x86	
Malware - SpyEye	Windows XP SP2 x86	
Malware - Stuxnet	Windows XP SP3 x86	
Malware - Cridex	Windows XP SP2 x86	
Malware - Shylock	Windows XP SP3 x86	
Malware - R2D2 (pw: infected)	Windows XP SP2 x86	
NIST (5 samples)	Windows XP SP2, 2003 SP0, and Vista Beta 2 (all x86)	
Hogfly's skydrive (13 samples)	Assorted (mostly Windows XP x86)	
Moyix's Fuzzy Hidden Process Sample	Windows XP SP3 x86	
Honeynet Banking Troubles Image	Windows XP SP2 x86	
NPS 2009-M57 (~70 samples)	Various XP / Vista x86	
Dougee's comparison samples	WIndows XP x86	
DFRWS 2008 Forensic Challenge	CentOS	
Honeynet Compromised Server Challenge	Linux Debian 2.6.26-26 x86	
Pikeworks Linux Samples	Linux CentOS and Ubuntu (x86/x64)	
DFRWS 2011 Forensics Challenge	Android	
DFRWS 2012 Rodeo	Android
Memory Samples · volatilityfoundation/volatility Wiki · GitHub
This is a list of publicly available memory samples for testing purposes.
Description OS 
Mac OSX 10.8.3 x64	Mac Mountain Lion 10.8.3 x64	
Jackcr's forensic challenge	Windows XP x86 and Windows 2003 SP0 x86 (4 images)	
GrrCon forensic challenge ISO (also see PDF questions)	Windows XP x86	
Malware - BlackEnergy	Windows XP SP2 x86	
Malware- CoreFlood	Windows XP SP2 x86	
Malware - Laqma	Windows XP SP2 x86	
Malware - Prolaco	Windows XP SP2 x86	
Malware - Sality	Windows XP SP2 x86	
Malware - Silentbanker	Windows XP SP2 x86	
Malware - Tigger	Windows XP SP2 x86	
Malware - Zeus	Windows XP SP2 x86	
Malware - SpyEye	Windows XP SP2 x86	
Malware - Stuxnet	Windows XP SP3 x86	
Malware - Cridex	Windows XP SP2 x86	
Malware - Shylock	Windows XP SP3 x86	
Malware - R2D2 (pw: infected)	Windows XP SP2 x86	
NIST (5 samples)	Windows XP SP2, 2003 SP0, and Vista Beta 2 (all x86)	
Hogfly's skydrive (13 samples)	Assorted (mostly Windows XP x86)	
Moyix's Fuzzy Hidden Process Sample	Windows XP SP3 x86	
Honeynet Banking Troubles Image	Windows XP SP2 x86	
NPS 2009-M57 (~70 samples)	Various XP / Vista x86	
Dougee's comparison samples	WIndows XP x86	
DFRWS 2008 Forensic Challenge	CentOS	
Honeynet Compromised Server Challenge	Linux Debian 2.6.26-26 x86	
Pikeworks Linux Samples	Linux CentOS and Ubuntu (x86/x64)	
DFRWS 2011 Forensics Challenge	Android	
DFRWS 2012 Rodeo	Android
Pull requests · stuxnet999/MemLabs · GitHub
Author 
Filter by author 
Loading Loading 
Label 
Filter by label Loading Loading 
Projects 
Filter by project Loading Loading 
Milestones 
Filter by milestone Loading Loading 
Reviews 
Filter by reviews 
Assignee 
Filter by who’s assigned 
Sort 
Sort by 
ProTip! Type g i on any issue or pull request to go back to the issue listing page.
Actions · stuxnet999/MemLabs · GitHub
Automate your workflow from idea to production
GitHub Actions makes it easy to automate all your software workflows, now with world-class CI/CD. Build, test, and deploy your code right from GitHub.
Linux, macOS, Windows, ARM, and containers
Hosted runners for every major OS make it easy to build and test all your projects. Run directly on a VM or inside a container. Use your own VMs, in the cloud or on-prem, with self-hosted runners.
Matrix builds
Save time with matrix workflows that simultaneously test across multiple operating systems and versions of your runtime.
Any language
GitHub Actions supports Node.js, Python, Java, Ruby, PHP, Go, Rust, .NET, and more. Build, test, and deploy applications in your language of choice.
Live logs
See your workflow run in realtime with color and emoji. It’s one click to copy a link that highlights a specific line number to share a CI/CD failure.
Built-in secret store
Automate your software development practices with workflow files embracing the Git flow by codifying it in your repository.
Multi-container testing
Test your web service and its DB in your workflow by simply adding some docker-compose to your workflow file.
Update readme · stuxnet999/MemLabs@adfd855 · GitHub
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
	
1		-
<img src="./Images/MemLabs-logo.png" alt="MemLabs" class="center">
	
	1	+
<img src="./Images/MemLabs.png" alt="MemLabs" class="center">
	
2	2		
3	3	
---
	
4	4
MemLabs/Lab 6 at 79ad019621f5e45519daa0b1de9f00c111cb5816 · stuxnet999/MemLabs · GitHub
We received this memory dump from the Intelligence Bureau Department. They say this evidence might hold some secrets of the underworld gangster David Benjamin. This memory dump was taken from one of his workers whom the FBI busted earlier this week. Your job is to go through the memory dump and see if you can figure something out. FBI also says that David communicated with his workers via the internet so that might be a good place to start.
Note: This challenge is composed of 1 flag split into 2 parts.
The flag format for this lab is: inctf{s0me_l33t_Str1ng}
Challenge file: MemLabs_Lab6
The commpressed archive
MD5 hash: e657a2aec85a66dafa828cde25528116
The memory dump
MD5 hash: 405985dc8ab7651c65cdbc04cb22961c
Please follow the flag submission rules when sending the email for solution verification.
MemLabs/Lab 6 at a7eb26f169ee66dd15578199c78cbaa7341b0bd6 · stuxnet999/MemLabs · GitHub
We received this memory dump from the Intelligence Bureau Department. They say this evidence might hold some secrets of the underworld gangster David Benjamin. This memory dump was taken from one of his workers whom the FBI busted earlier this week. Your job is to go through the memory dump and see if you can figure something out. FBI also says that David communicated with his workers via the internet so that might be a good place to start.
Note: This challenge is composed of 1 flag split into 2 parts.
The flag format for this lab is: inctf{s0me_l33t_Str1ng}
Challenge file: MemLabs_Lab6
The commpressed archive
MD5 hash: e657a2aec85a66dafa828cde25528116
The memory dump
MD5 hash: 405985dc8ab7651c65cdbc04cb22961c
Please follow the flag submission rules when sending the email for solution verification.
MemLabs/Lab 5 at a7eb26f169ee66dd15578199c78cbaa7341b0bd6 · stuxnet999/MemLabs · GitHub
We received this memory dump from our client recently. Someone accessed his system when he was not there and he found some rather strange files being accessed. Find those files and they might be useful. I quote his exact statement,
The names were not readable. They were composed of alphabets and numbers but I wasn't able to make out what exactly it was.
Also, he noticed his most loved application that he always used crashed every time he ran it. Was it a virus?
Note-1: There was a small mistake when making this challenge. If you find any string which has the string "L4B_3_D0n3!!" in it, please change it to "L4B_5_D0n3!!" and then proceed.
Note-2: You'll get the stage 2 flag only when you have the stage 1 flag.
Challenge file: MemLabs_Lab5
The commpressed archive
MD5 hash: d72a2141baa6670d46c77b5f452f09f7
The memory dump
MD5 hash: 9dd6cb1134c9b018020bad44f27394db
Please follow the flag submission rules when sending the email for solution verification.
MemLabs/Lab 6 at 21508294496c564a20e8b6b9f0c6adc3abf20fdf · stuxnet999/MemLabs · GitHub
Note: This challenge is composed of 1 flag.
The flag format for this lab is: inctf{s0me_l33t_Str1ng}
Challenge file: MemLabs_Lab6
Please follow the flag submission rules when sending the email for solution verification.
MemLabs/Lab 6 at f31c778aa5a24a6ee97f002bad25d696d16ade58 · stuxnet999/MemLabs · GitHub
Note: This challenge is composed of 1 flag.
The flag format for this lab is: inctf{s0me_l33t_Str1ng}
Challenge file: MemLabs_Lab6
Please follow the flag submission rules when sending the email for solution verification.
Updating descriptions · stuxnet999/MemLabs@f31c778 · GitHub
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
	
4	4		
5	5	
My sister's computer crashed. We were very fortunate to recover this memory dump. Your job is get all her important files from the system. From what we remember, we suddenly saw a black window pop up with some thing being executed. When the crash happened, she was trying to draw something. Thats all we remember from the time of crash.
	
6	6		
7		-
This challenge is composed of 3 flags.
	
	7	+
**Note**: This challenge is composed of 3 flags.
	
8	8		
9	9	
**Challenge file**: [MemLabs_Lab1](https://mega.nz/#!6l4BhKIb!l8ATZoliB_ULlvlkESwkPiXAETJEF7p91Gf9CWuQI70)
	
10	10		
	
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,8 @@
	
4	4		
5	5	
One of the clients of our company, lost the access to his system due to an unknown error. He is supposedly a very popular "environmental" activist. As a part of the investigation, he told us that his go to applications are browsers, his password managers etc. We hope that you can dig into this memory dump and find his important stuff and give it back to us.
	
6	6		
	7	+
**Note**: This challenge is composed of 3 flags.
	
	8	+	
7	9	
**Challenge file**: [MemLabs_Lab2](https://mega.nz/#!ChoDHaja!1XvuQd49c7-7kgJvPXIEAst-NXi8L3ggwienE1uoZTk)
	
8	10		
9	11	
Please follow the [flag submission rules](https://github.com/stuxnet999/MemLabs#flag-submission) when sending the email for solution verification.
	
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
	
4	4		
5	5	
A malicious script encrypted a very secret piece of information I had on my system. Can you recover the information for me please?
	
6	6		
7		-
This challenge is composed of only 1 flag and split into 2 parts.
	
	7	+
**Note**: This challenge is composed of only 1 flag and split into 2 parts.
	
8	8		
9	9	
**Hint**: You'll need the first half of the flag to get the second.
	
10	10		
	
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,8 @@ This challenge is composed of 2 flags but do you really think so? Maybe a little
	
6	6		
7	7	
**Note**: There was a small mistake when making this challenge. If you find any string which has the string "**_L4B_3_D0n3_!!**" in it, please change it to "**_L4B_5_D0n3_!!**" and then proceed.
	
8	8		
	9	+
**Hint**: You'll get the stage 2 flag only when you have the stage 1 flag.
	
	10	+	
9	11	
**Challenge file**: [MemLabs_Lab5](https://mega.nz/#!Ps5ViIqZ!UQtKmUuKUcqqtt6elP_9OJtnAbpwwMD7lVKN1iWGoec)
	
10	12		
11	13	
Please follow the [flag submission rules](https://github.com/stuxnet999/MemLabs#flag-submission) when sending the email for solution verification.
	
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
	
2	2		
3	3	
## **Challenge Description**
	
4	4		
5		-
This challenge is composed of 1 flag.
	
	5	+
**Note**: This challenge is composed of 1 flag.
	
6	6		
7	7	
The flag format for this lab is: **inctf{s0me_l33t_Str1ng}**
	
8	8
MemLabs/Lab 6 at 009c0bbf054a8169a20ae2eb4de8c020d74a6faf · stuxnet999/MemLabs · GitHub
We received this memory dump from the Intelligence Bureau Department. They say this evidence might hold some secrets of the underworld gangster David Benjamin. This memory dump was taken from one of his workers whom the FBI busted earlier this week. Your job is to go through the memory dump and see if you can figure something out. FBI also says that David communicated with his workers via the internet so that might be a good place to start.
Note: This challenge is composed of 1 flag split into 2 parts.
The flag format for this lab is: inctf{s0me_l33t_Str1ng}
Challenge file: MemLabs_Lab6
The commpressed archive
MD5 hash: e657a2aec85a66dafa828cde25528116
The memory dump
MD5 hash: 405985dc8ab7651c65cdbc04cb22961c
Please follow the flag submission rules when sending the email for solution verification.