PARTICIPANTE: DANIEL ESCOBAR PINTO

FECHA: 02/12/2021
------------------------------------------------------------------------------------------------------------

CASO PRACTICO I

Análisis Forense de Dispositivos Móviles

Hemos confiscado el celular de un sospechoso llamado Mr X, hemos volcado los datos del mismo (fichero
adjunto a esta práctica) y necesitamos que se analicen dichos datos y nos puedan ayudar con las siguientes
preguntas:

• ¿Qué tramaba Mr X?
R.- Descifrar algunas contraseñas de un archivo obtenido de la agencia “3 letters agency”

• ¿A quién le pidió ayuda inicialmente?

R.- A Matt Murdock

• ¿Quién le intento ayudar? ¿Por cuánto dinero?

R.- Danny Rand por un consto de $ 10,000 por semana

• ¿Quién le paso el enlace del fichero a Mr X?

R.- Jessica Jones

• ¿Cuál es dicho enlace?

R.- https://cyberhades.ams3.digitaloceanspaces.com

Si fuera posible también nos interesa:

• El historial del navegador, incluyendo cookies si es posible

R.-

https://platform.twitter.com/widgets/follow_button.2e9f365dae390394eb8d923cba8c5b11.en.html

https://images.ads.supplyframe.com/8005ee4840599079e7cfc89b2f83bd07.png

https://cdn.doubleverify.com/dvtp_src.js?
ctx=3397726&cmp=3398513&sid=pp3&plc=33985131&advid=3398311&adsrv=0&btreg=&btadsrv=&tagtype=
&dvtagver=6.1.src&DVP_PROG_REP=1&DVP_DV_TT=1&DVP_DV_CT=1&DVP_PP_ID=3&DVPX_PP_IMP_ID=AB
AjH0hm7kqXZXE_pX54YAlTUR0s&DVP_DBM_1=849135&DVP_DBM_2=7265385&DVP_DBM_3=23401188&DVP_
DBM_4=156158852&DVP_DBM_5=1&DVP_DBM_6=1&DVP_DBM_7=101267050391&turl=https://
www.guru99.com/how-to-crack-password-of-an-application.html

https://www.youtube.com/generate_204?Owt5pw

https://mk0resourcesinfm536w.kinstacdn.com/wp-content/plugins/akismet/_inc/form.js?ver=4.1
https://px.ads.linkedin.com/collect/?time=1557395367182&pid=448354&url=https%3A%2F
%2Fresources.infosecinstitute.com%2F10-popular-password-cracking-tools%2F
%23gref&fmt=js&s=1&cookiesTest=true&liSync=true

https://i2.wp.com/cdn.hackaday.io/images/resize/360x270/8309191536900083044.jpg?
resize=500%2C500&ssl=1RIFF

https://www.google.com/logos/doodles/2016/new-years-eve-2016-5637797688901632-hp.gifGIF89aX

https://api.opmnstr.com/v2/embed/23663/ucjda2rt8xm4ppvufexf

https://cdn.ampproject.org/preconnect.gif?0.09088542428798974GIF89a

https://www.googletagservices.com/dcm/dcmads.js?
gdpr=0&gdpr_consent=BAAAAAAAAAAAAABABBktCP6AAAAAEA

https://content.quantcount.com/adchoices/img/adc.png

https://s3-us-west-2.amazonaws.com/infosec-institute/assets/logos/infosecskills-logo-white-CENTER.svg

https://c.disquscdn.com/next/embed/assets/img/gif-picker.df38180f2d048c25fe42a2b440ff863e.svg

https://secure.gravatar.com/avatar/1af5678462511d156f5a3e204c8bdd2f?s=64&d=mm&r=g

https://www.guru99.com/images/logo/logo.png

https://www.facebook.com/tr/?id=1774182812839263&ev=PageView&dl=https%3A%2F%2Fhackaday.com
%2F&rl=&if=false&ts=1557366332200&sw=360&sh=640&v=2.8.47&r=stable&ec=0&o=30&fbp=fb.1.1557366
332191.594863907&it=1557366331685&coo=false&rqm=GETGIF89a

https://mk0resourcesinfm536w.kinstacdn.com/wp-includes/css/dashicons.min.css?ver=4.9.6

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net
%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID
%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer
%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp
%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com
%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc
%2525253D1&google_gid=CAESENvQq1MiaDs-
HdEEatv0yDQ&google_cver=1&google_push=AHNF13Ig85rvlj97lzhPBoyr0sZ4fye7-bsekLORwtStrQ

https://c.disquscdn.com/next/embed/assets/img/link.5ef9a39f22ce49f926e304567b9d611b.svg

https://www.google.com/xjs/_/js/k=xjs.qs.en_US.rFtUZ4BvPzo.O/
am=GAAAizg7ExOGABNwC4AinAb2XgDgBBBCAQQg/d=1/
exm=AHO0ue,ByqdBd,CiVnBc,Fkg7bd,HcFEGb,IM1CJf,MB3mMb,MkIO9c,NBZ7u,QfiAub,RMhBfe,RqxLvf,SvnKM,T
4BAC,T7XTS,URQPYc,Uox2uf,XjCeUc,aCZVp,aa,abd,amp,ampfp,async,bct,bgd,cdos,csi,czrJpf,d,dvl,eN4qad,expY
zc,fgjet,foot,fpv,gl5fbe,hsm,icr,if1iFc,jsa,kopZwe,kpc,kpci,mUpTid,mu,o02Jie,p2s6Uc,pB6Zqd,pvtlp,qik19b,qim,r,
rHjpXd,ryf4xf,sb_wiz,sf,tl,uz938c,vWNDde,vrml,vs,wqoyyb,ws9Tlc,xPR7tc,xpltpb,xz7cCd,yQ43ff,yc31df,zbML3c/
ed=1/dg=2/rs=ACT90oGLvmHk7CgMnkX3BbU_GhvkVZ_FOQ/
m=TrMQ4c,WlxEYd,Wq6lxf,lazG7b,mI3LFb,oc8g5d?xjs=s2

https://cdn.ampproject.org/rtv/011904301721170/v0/amp-form-0.1.js

https://i2.wp.com/cdn.tindiemedia.com/images/resize/qMq1waHWs1oeb5hVLhLPz_bHSzg=/p/622x415/smart/
i/32517/products/2017-04-20T17%3A39%3A50.745Z-mini_in_box.JPG?zoom=3&resize=342%2C257&ssl=1
https://static.xx.fbcdn.net/rsrc.php/v3iEpO4/yx/l/en_US/fYqks2HDirF.js

https://connect.facebook.net/en_US/sdk.js?hash=32d4c727a80e189f1131b23135f61d1b

https://resources.infosecinstitute.com/wp-content/themes/infosec/assets/typography/montserrat-light-
webfont.woff?1428598187wOFF

https://apis.google.com/js/api.js

https://tpc.googlesyndication.com/pagead/js/r20190506/r20110914/client/ext/m_load_preloaded_resource.js

https://cdn.doubleverify.com/dvbs_src_internal63.js

https://match.zorosrv.com/match?tabid=1c23606c-4e37-41e1-8011-5365947b14a0-
tuct3cd7cfa&extuid=1&excid=11&query=taboola_hm%3D1&cijs=0

https://c.disquscdn.com/next/embed/discovery.bundle.05463248c2ace681de05d193251bc001.js

https://go.pardot.com/css/form.css?ver=20121030

http://www.cyberhades.com/

https://www.google.com/complete/search?q=how%20to%20crack%20a%20p&cp=16&client=mobile-gws-wiz-
hp&xssi=t&hl=en&authuser=0&psi=T4bTXJuSCIfs5gLV0rLwDw.1557366353370&ei=T4bTXJuSCIfs5gLV0rLwDw
&dpr=3

https://a248.e.akamai.net/appnexus.download.akamai.com/89298/adnexus-prod/p/7a/06/
d2/82/7a06d282f433ec0d3bc1382c633efb08.jpg

https://disqus.com/api/3.0/discovery/listTopPost.json?
thread=5651985029&thread=5652483663&thread=5656105858&thread=5729393876&thread=5879332574&th
read=6016346610&thread=6326875966&thread=6878050848&api_key=E8Uh5l5fHZ6gD8U3KycjAIAk46f68Zw7
C6eW8WSjZvCLXebZ7p0r1yrYDrLilk2F

https://www.youtube.com/embed/LLBLjqa18y0

https://p.rfihub.com/cm?in=1&pub=345&userid=311972100389478579GIF89a

https://fonts.googleapis.com/css?family=Montserrat:500&subset=latin

https://hackaday.com/wp-content/uploads/2019/05/how-machining-went-from-art-to-science-lathe-chips-
thumb.jpeg?w=600&h=600RIFFf

https://player.mediabong.net/sync/plsp?uid=k55Pa5oXtm4JGIF89a
• La lista de contactos

R.-

Contactos:

Nombre Número de Teléfono celular

Danny Rand 650-555-2222
Franck Castle 650-555-3333
Jessica Jones 650-555-4444
Matt Murdock 650-555-1111

• Versión del sistema operativo del celular

Android lollipop v22 (5.1.1-5525941)

• Aplicaciones instaladas

R.-
• Cuentas registradas

R.- org.troncoso.smart-2