REGEDIT4

[HKEY_LOCAL_MACHINE\Software\Network Instruments\Observer\Filters\(Virus) Sober.j]
"FilterBuffer"=hex:97,05,00,00,30,00,00,00,17,00,3b,00,1f,00,1e,00,00,92,00,06,\
  00,25,00,00,00,00,00,00,00,00,00,1c,00,52,00,00,00,35,00,50,03,00,00,8b,60,\
  40,0a,00,00,00,00,00,00,00,00,00,00,00,00,17,00,00,00,86,01,1e,00,00,5a,00,\
  11,00,35,00,00,00,00,00,00,00,00,00,1c,00,6e,00,00,00,35,00,50,8c,00,00,c6,\
  48,48,0a,00,00,00,00,00,00,00,00,00,00,00,00,1c,00,8a,00,00,00,35,00,50,2b,\
  00,00,c0,2b,e0,12,00,00,00,00,00,00,00,00,00,00,00,00,1c,00,a6,00,00,00,35,\
  00,50,ee,00,00,96,fe,b7,0f,00,00,00,00,00,00,00,00,00,00,00,00,1c,00,c2,00,\
  00,00,35,00,50,ab,00,00,c1,05,d8,0e,00,00,00,00,00,00,00,00,00,00,00,00,1c,\
  00,de,00,00,00,35,00,50,2c,00,00,80,3b,27,30,00,00,00,00,00,00,00,00,00,00,\
  00,00,1c,00,fa,00,00,00,35,00,50,e0,00,00,80,8a,8c,2c,00,00,00,00,00,00,00,\
  00,00,00,00,00,1c,00,16,01,00,00,35,00,50,8d,00,00,84,a3,04,67,00,00,00,00,\
  00,00,00,00,00,00,00,00,1c,00,32,01,00,00,35,00,50,46,00,00,86,e2,51,03,00,\
  00,00,00,00,00,00,00,00,00,00,00,1c,00,4e,01,00,00,35,00,50,85,00,00,80,02,\
  88,47,00,00,00,00,00,00,00,00,00,00,00,00,1c,00,6a,01,00,00,35,00,50,31,00,\
  00,83,bc,03,dc,00,00,00,00,00,00,00,00,00,00,00,00,1c,00,00,00,00,00,35,00,\
  50,ce,00,00,c1,cc,72,e9,00,00,00,00,00,00,00,00,00,00,00,00,1c,00,de,01,a2,\
  01,35,00,50,86,00,00,8d,28,0a,23,00,00,00,00,00,00,00,00,00,00,00,00,3c,00,\
  fa,01,00,00,1f,00,00,32,1c,00,02,00,01,00,07,00,02,00,00,dc,05,00,0d,6d,69,\
  63,72,6f,73,6f,66,74,2e,63,6f,6d,01,00,07,00,02,00,00,dc,05,00,0b,62,69,67,\
  66,6f,6f,74,2e,63,6f,6d,1c,00,6b,02,a2,01,35,00,50,1a,00,00,a6,3c,0c,0b,00,\
  00,00,00,00,00,00,00,00,00,00,00,39,00,33,02,00,00,1f,00,00,0f,19,00,02,00,\
  01,00,07,00,02,00,00,dc,05,00,0a,67,6f,6f,67,6c,65,2e,63,6f,6d,01,00,07,00,\
  02,00,00,dc,05,00,0b,68,6f,74,6d,61,69,6c,2e,63,6f,6d,38,00,00,00,00,00,1f,\
  00,00,a5,18,00,02,00,01,00,07,00,02,00,00,dc,05,00,09,79,61,68,6f,6f,2e,63,\
  6f,6d,01,00,07,00,02,00,00,dc,05,00,0b,74,2d,6f,6e,6c,69,6e,65,2e,64,65,1c,\
  00,87,02,a2,01,35,00,50,fe,00,00,cf,45,bc,ba,00,00,00,00,00,00,00,00,00,00,\
  00,00,1c,00,a3,02,a2,01,35,00,50,de,00,00,d9,ed,96,e1,00,00,00,00,00,00,00,\
  00,00,00,00,00,1c,00,bf,02,a2,01,35,00,50,c5,00,00,c0,23,e8,22,00,00,00,00,\
  00,00,00,00,00,00,00,00,1c,00,db,02,a2,01,35,00,50,ac,00,00,d4,47,61,9c,00,\
  00,00,00,00,00,00,00,00,00,00,00,1c,00,f7,02,a2,01,35,00,50,93,00,00,c1,9e,\
  7c,8f,00,00,00,00,00,00,00,00,00,00,00,00,1c,00,13,03,a2,01,35,00,50,5f,00,\
  00,3d,5f,86,a8,00,00,00,00,00,00,00,00,00,00,00,00,1c,00,2f,03,a2,01,35,00,\
  50,42,00,00,d9,74,e0,fd,00,00,00,00,00,00,00,00,00,00,00,00,1c,00,4b,03,a2,\
  01,35,00,50,23,00,00,d0,30,22,87,00,00,00,00,00,00,00,00,00,00,00,00,1c,00,\
  67,03,a2,01,35,00,50,07,00,00,81,bb,0a,19,00,00,00,00,00,00,00,00,00,00,00,\
  00,1c,00,83,03,a2,01,35,00,50,ea,00,00,d1,eb,6b,0e,00,00,00,00,00,00,00,00,\
  00,00,00,00,1c,00,9f,03,a2,01,35,00,50,cb,00,00,d8,cb,73,69,00,00,00,00,00,\
  00,00,00,00,00,00,00,1c,00,bb,03,a2,01,35,00,50,9b,00,00,cf,d9,78,2b,00,00,\
  00,00,00,00,00,00,00,00,00,00,1c,00,d7,03,a2,01,35,00,50,6e,00,00,83,ae,08,\
  0e,00,00,00,00,00,00,00,00,00,00,00,00,1c,00,f3,03,a2,01,35,00,50,4c,00,00,\
  cb,a2,00,0b,00,00,00,00,00,00,00,00,00,00,00,00,1c,00,0f,04,a2,01,35,00,50,\
  28,00,00,c3,b6,60,1d,00,00,00,00,00,00,00,00,00,00,00,00,1c,00,2b,04,a2,01,\
  35,00,50,ff,00,00,91,fd,02,ab,00,00,00,00,00,00,00,00,00,00,00,00,1c,00,47,\
  04,a2,01,35,00,50,e3,00,00,3e,27,59,47,00,00,00,00,00,00,00,00,00,00,00,00,\
  1c,00,63,04,a2,01,35,00,50,a2,00,00,8d,28,0a,23,00,00,00,00,00,00,00,00,00,\
  00,00,00,1c,00,7f,04,a2,01,35,00,50,8b,00,00,81,bb,10,01,00,00,00,00,00,00,\
  00,00,00,00,00,00,1c,00,9b,04,a2,01,35,00,50,6b,00,00,83,f3,40,03,00,00,00,\
  00,00,00,00,00,00,00,00,00,1c,00,b7,04,a2,01,35,00,50,51,00,00,50,94,0b,e7,\
  00,00,00,00,00,00,00,00,00,00,00,00,1c,00,d3,04,a2,01,35,00,50,33,00,00,c3,\
  70,c3,22,00,00,00,00,00,00,00,00,00,00,00,00,1c,00,ef,04,a2,01,35,00,50,0e,\
  00,00,52,c3,ea,02,00,00,00,00,00,00,00,00,00,00,00,00,1c,00,0b,05,a2,01,35,\
  00,50,e9,00,00,97,c9,00,27,00,00,00,00,00,00,00,00,00,00,00,00,1c,00,27,05,\
  a2,01,35,00,50,ca,00,00,d4,f2,58,02,00,00,00,00,00,00,00,00,00,00,00,00,1c,\
  00,43,05,a2,01,35,00,50,3f,00,00,d5,da,aa,06,00,00,00,00,00,00,00,00,00,00,\
  00,00,1c,00,5f,05,a2,01,35,00,50,a8,00,00,c8,4a,d6,f6,00,00,00,00,00,00,00,\
  00,00,00,00,00,1c,00,7b,05,a2,01,35,00,50,84,00,00,d5,ef,ea,6c,00,00,00,00,\
  00,00,00,00,00,00,00,00,1c,00,00,00,a2,01,35,00,50,5e,00,00,d9,ed,97,21,00,\
  00,00,00,00,00,00,00,00,00,00,00
"szDescr"="The sending machine may be infected with the Sober.j virus."
"szFolder"="Virus Filters"
"RGBValue"=dword:00800080
"bFilterBasedAlarm"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Network Instruments\Observer\ProtocolPresetsV9]