REGEDIT4

[HKEY_LOCAL_MACHINE\Software\Network Instruments\Observer\Filters\(Hack) Sub Seven 1]
"FilterBuffer"=hex:3a,00,00,00,02,00,00,00,17,00,00,00,1f,00,1e,00,00,4e,01,06,\
  00,db,04,00,00,01,00,00,04,00,00,1b,00,00,00,00,00,1f,00,00,96,00,00,00,00,\
  01,00,02,00,01,0d,00,00,00,02,02,12,00
"szDescr"="This event indicates that a known trojan may be operating on the host. This is not a scan or probe, but a successful connection."
"RGBValue"=dword:000000ff
"bFilterBasedAlarm"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Network Instruments\Observer\ProtocolPresetsV9]