emphasis in existing malware research is focused on technical analysis of malware samples, this purely technical approach is unlikely to yield a complete picture. For example, through field research we have found compromised computers checking in with command and control servers that we have not seen in malware samples