REGEDIT4

[HKEY_LOCAL_MACHINE\Software\Network Instruments\Observer\Filters\(Hack) Sub Seven 2.1]
"FilterBuffer"=hex:3a,00,00,00,02,00,00,00,17,00,00,00,1f,00,1e,00,00,52,01,06,\
  00,ee,6a,00,00,00,00,00,00,00,00,1b,00,00,00,00,00,1f,00,00,9c,00,00,00,00,\
  01,00,02,00,01,0d,00,00,00,02,02,12,00
"szDescr"="This event indicates that a known trojan may be operating on the host. This is not a scan or probe, but response to a connection request. TCP port 27374 is the default port used by SubSeven-2.1/2.2-Gold. "
"RGBValue"=dword:000000ff
"bFilterBasedAlarm"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Network Instruments\Observer\ProtocolPresetsV9]