1. Sec 503.5 Case 2 Solution

2. Find a string in a packet

3. Find the string smsses.exe

4. Frame 208 is the 1 st Fragment

5. Frame 209 gives us the last fragment frame

6. Frame 231 is the Last Fragment and Contains the File Size

7. Analyze>Follow TCP Stream shows the PE Header (MZ)

8. Further into the stream is the end of the executable

9. Save the raw file

10. The extract_file.raw is considerably larger than SMSSES.EXE (file size 24576)

11. Open extract_file.raw in Hex Editor

12. Locate the Header MZ or Hex 4D5A90

13. Remove Packet Data before MZ Header

14. File after removing bytes preceeding MZ Header

15. 24576 is 6000 in Hex

16. Remove everything after the offset

17. Find ics.exe

18. Packet 8092 start of tranfer

19. Packet 8093 shows last fragment is 8134 (which will have the file size)

20. File size is 45056

21. Total size of raw file