Sec Case 2 Solution
Find a string in a packet
Find the string smsses.exe
Frame 208 is the 1 st Fragment
Frame 209 gives us the last fragment frame
Frame 231 is the Last Fragment and Contains the File Size
Analyze>Follow TCP Stream shows the PE Header (MZ)
Further into the stream is the end of the executable
Save the raw file
The extract_file.raw is considerably larger than SMSSES.EXE (file size 24576)
Open extract_file.raw in Hex Editor
Locate the Header MZ or Hex 4D5A90
Remove Packet Data before MZ Header
File after removing bytes preceeding MZ Header
24576 is 6000 in Hex
Remove everything after the offset
Find ics.exe
Packet 8092 start of tranfer
Packet 8093 shows last fragment is 8134 (which will have the file size)
File size is 45056
Total size of raw file