There is only 1 instance running. I did do a WHOIS on the IP even though im not sure what a WHOIS really does but it gave me the location of the place and a website and a bunch of other info i don't really understand. it's anywhere from korea to russia to colorado. but heres the problem at any one time theres anyhwere from 3-35 IP's that services.exe is connecting too. I'm not sure what you mean by TCP packets or how to tell what protocol im seeing. i can tell you however that within 2 hrs services.exe has recieve 8,000 kb and sent 20,000 and it they increases anyhwere from .5-3 kb each secon