<data xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
<row _id="1"><ip.session_id>1</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>4</ip.pkts_per_flow><duration>0.028773069381713867</duration><ip.header_len>80</ip.header_len><ip.payload_len>128</ip.payload_len><ip.avg_bytes_tot_len>76.8</ip.avg_bytes_tot_len><time_between_pkts_sum>28.773069381713867</time_between_pkts_sum><time_between_pkts_avg>7.193267345428467</time_between_pkts_avg><time_between_pkts_max>14.525175094604492</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>7.6085945785090905</time_between_pkts_std><(-0.001, 50.0]>4</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>4</tcp_pkts_per_flow><pkts_rate>139.01888418418503</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>139.01888418418503</byte_rate><tcp.tcp_session_payload_up_len>4</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>4</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>4</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>4</tcp.ack><tcp.urg>0</tcp.urg><sport_g>4</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>4</dport_le><mean_tcp_pkts>59602</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>59602</min_tcp_pkts><max_tcp_pkts>59602</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2"><ip.session_id>1</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>0.0</duration><ip.header_len>20</ip.header_len><ip.payload_len>156</ip.payload_len><ip.avg_bytes_tot_len>76.8</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.0</pkts_rate><tcp_bytes_per_flow>124</tcp_bytes_per_flow><byte_rate>0.0</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>1</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>22</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>22</min_tcp_pkts><max_tcp_pkts>22</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>124</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>124</min_tcp_len><max_tcp_len>124</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="3"><ip.session_id>2</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>22</ip.pkts_per_flow><duration>21.602761030197144</duration><ip.header_len>440</ip.header_len><ip.payload_len>440</ip.payload_len><ip.avg_bytes_tot_len>40.0</ip.avg_bytes_tot_len><time_between_pkts_sum>15943.00627708435</time_between_pkts_sum><time_between_pkts_avg>724.6821035038341</time_between_pkts_avg><time_between_pkts_max>1000.2660751342773</time_between_pkts_max><time_between_pkts_min>8.793115615844727</time_between_pkts_min><time_between_pkts_std>406.44869584192213</time_between_pkts_std><(-0.001, 50.0]>3</(-0.001, 50.0]><(50.0, 100.0]>2</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>1</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>0</tcp_pkts_per_flow><pkts_rate>0.0</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.0</byte_rate><tcp.tcp_session_payload_up_len>0</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>0</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>0</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>0</dport_le><mean_tcp_pkts>0</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>0</min_tcp_pkts><max_tcp_pkts>0</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="4"><ip.session_id>3</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>4</ip.pkts_per_flow><duration>9.634510040283203</duration><ip.header_len>80</ip.header_len><ip.payload_len>314</ip.payload_len><ip.avg_bytes_tot_len>120.1</ip.avg_bytes_tot_len><time_between_pkts_sum>485.5778217315674</time_between_pkts_sum><time_between_pkts_avg>121.39445543289185</time_between_pkts_avg><time_between_pkts_max>460.129976272583</time_between_pkts_max><time_between_pkts_min>0.00095367431640625</time_between_pkts_min><time_between_pkts_std>226.1206193202246</time_between_pkts_std><(-0.001, 50.0]>3</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>1</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>0</tcp_pkts_per_flow><pkts_rate>0.0</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.0</byte_rate><tcp.tcp_session_payload_up_len>0</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>0</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>0</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>0</dport_le><mean_tcp_pkts>0</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>0</min_tcp_pkts><max_tcp_pkts>0</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="5"><ip.session_id>3</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>6</ip.pkts_per_flow><duration>10.344114065170288</duration><ip.header_len>120</ip.header_len><ip.payload_len>687</ip.payload_len><ip.avg_bytes_tot_len>120.1</ip.avg_bytes_tot_len><time_between_pkts_sum>0.34689903259277344</time_between_pkts_sum><time_between_pkts_avg>0.057816505432128906</time_between_pkts_avg><time_between_pkts_max>0.10585784912109375</time_between_pkts_max><time_between_pkts_min>0.030040740966796875</time_between_pkts_min><time_between_pkts_std>0.02709624791427504</time_between_pkts_std><(-0.001, 50.0]>6</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>0</tcp_pkts_per_flow><pkts_rate>0.0</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.0</byte_rate><tcp.tcp_session_payload_up_len>0</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>0</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>0</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>0</dport_le><mean_tcp_pkts>0</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>0</min_tcp_pkts><max_tcp_pkts>0</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="6"><ip.session_id>4</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.060002088546753</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.48543640104047614</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.48543640104047614</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>39836</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>39836</min_tcp_pkts><max_tcp_pkts>39836</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="7"><ip.session_id>4</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.0601449012756348</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.03600120544433594</time_between_pkts_sum><time_between_pkts_avg>0.03600120544433594</time_between_pkts_avg><time_between_pkts_max>0.03600120544433594</time_between_pkts_max><time_between_pkts_min>0.03600120544433594</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.48540274976813685</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.48540274976813685</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>443</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>443</min_tcp_pkts><max_tcp_pkts>443</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="8"><ip.session_id>5</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.060002088546753</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>40.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.48543640104047614</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.48543640104047614</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>39836</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>39836</min_tcp_pkts><max_tcp_pkts>39836</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="9"><ip.session_id>5</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.0601539611816406</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>40.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.009059906005859375</time_between_pkts_sum><time_between_pkts_avg>0.009059906005859375</time_between_pkts_avg><time_between_pkts_max>0.009059906005859375</time_between_pkts_max><time_between_pkts_min>0.009059906005859375</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.48540061512025584</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.48540061512025584</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>80</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>80</min_tcp_pkts><max_tcp_pkts>80</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="10"><ip.session_id>6</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.206873893737793</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>146.68989181518555</time_between_pkts_sum><time_between_pkts_avg>146.68989181518555</time_between_pkts_avg><time_between_pkts_max>146.68989181518555</time_between_pkts_max><time_between_pkts_min>146.68989181518555</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>0</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>1</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4531296522368549</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4531296522368549</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="11"><ip.session_id>6</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.2069449424743652</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.07104873657226562</time_between_pkts_sum><time_between_pkts_avg>0.07104873657226562</time_between_pkts_avg><time_between_pkts_max>0.07104873657226562</time_between_pkts_max><time_between_pkts_min>0.07104873657226562</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4531150645193839</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4531150645193839</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>3306</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>3306</min_tcp_pkts><max_tcp_pkts>3306</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="12"><ip.session_id>7</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>2</ip.pkts_per_flow><duration>2.2369771003723145</duration><ip.header_len>40</ip.header_len><ip.payload_len>44</ip.payload_len><ip.avg_bytes_tot_len>42.666666666666664</ip.avg_bytes_tot_len><time_between_pkts_sum>29.857158660888672</time_between_pkts_sum><time_between_pkts_avg>14.928579330444336</time_between_pkts_avg><time_between_pkts_max>29.857158660888672</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>21.11219935607704</time_between_pkts_std><(-0.001, 50.0]>2</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>2</tcp_pkts_per_flow><pkts_rate>0.8940636896404202</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.8940636896404202</byte_rate><tcp.tcp_session_payload_up_len>2</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>2</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>2</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>2</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>2</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="13"><ip.session_id>7</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.20699405670166</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.666666666666664</ip.avg_bytes_tot_len><time_between_pkts_sum>0.049114227294921875</time_between_pkts_sum><time_between_pkts_avg>0.049114227294921875</time_between_pkts_avg><time_between_pkts_max>0.049114227294921875</time_between_pkts_max><time_between_pkts_min>0.049114227294921875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4531049809415863</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4531049809415863</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>22</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>22</min_tcp_pkts><max_tcp_pkts>22</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="14"><ip.session_id>8</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.206873893737793</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4531296522368549</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4531296522368549</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="15"><ip.session_id>8</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.207005023956299</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.010967254638671875</time_between_pkts_sum><time_between_pkts_avg>0.010967254638671875</time_between_pkts_avg><time_between_pkts_max>0.010967254638671875</time_between_pkts_max><time_between_pkts_min>0.010967254638671875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4531027293301717</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4531027293301717</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>5900</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>5900</min_tcp_pkts><max_tcp_pkts>5900</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="16"><ip.session_id>9</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.207036018371582</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.030994415283203125</time_between_pkts_sum><time_between_pkts_avg>0.030994415283203125</time_between_pkts_avg><time_between_pkts_max>0.030994415283203125</time_between_pkts_max><time_between_pkts_min>0.030994415283203125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4530963662015042</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4530963662015042</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="17"><ip.session_id>9</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.207068920135498</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.031948089599609375</time_between_pkts_sum><time_between_pkts_avg>0.031948089599609375</time_between_pkts_avg><time_between_pkts_max>0.031948089599609375</time_between_pkts_max><time_between_pkts_min>0.031948089599609375</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4530896116912413</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4530896116912413</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>993</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>993</min_tcp_pkts><max_tcp_pkts>993</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="18"><ip.session_id>10</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.207036018371582</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4530963662015042</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4530963662015042</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="19"><ip.session_id>10</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.2070839405059814</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.015020370483398438</time_between_pkts_sum><time_between_pkts_avg>0.015020370483398438</time_between_pkts_avg><time_between_pkts_max>0.015020370483398438</time_between_pkts_max><time_between_pkts_min>0.015020370483398438</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.45308652817742245</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.45308652817742245</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>445</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>445</min_tcp_pkts><max_tcp_pkts>445</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="20"><ip.session_id>11</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.207036018371582</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4530963662015042</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4530963662015042</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="21"><ip.session_id>11</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.20709490776062</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.010967254638671875</time_between_pkts_sum><time_between_pkts_avg>0.010967254638671875</time_between_pkts_avg><time_between_pkts_max>0.010967254638671875</time_between_pkts_max><time_between_pkts_min>0.010967254638671875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.45308427674939805</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.45308427674939805</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1723</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1723</min_tcp_pkts><max_tcp_pkts>1723</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="22"><ip.session_id>12</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.2070369720458984</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.00095367431640625</time_between_pkts_sum><time_between_pkts_avg>0.00095367431640625</time_between_pkts_avg><time_between_pkts_max>0.00095367431640625</time_between_pkts_max><time_between_pkts_min>0.00095367431640625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.45309617041576394</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.45309617041576394</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="23"><ip.session_id>12</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.207102060317993</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.007152557373046875</time_between_pkts_sum><time_between_pkts_avg>0.007152557373046875</time_between_pkts_avg><time_between_pkts_max>0.007152557373046875</time_between_pkts_max><time_between_pkts_min>0.007152557373046875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.45308280843882803</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.45308280843882803</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>443</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>443</min_tcp_pkts><max_tcp_pkts>443</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="24"><ip.session_id>13</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.2070369720458984</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.45309617041576394</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.45309617041576394</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="25"><ip.session_id>13</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.2071099281311035</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.007867813110351562</time_between_pkts_sum><time_between_pkts_avg>0.007867813110351562</time_between_pkts_avg><time_between_pkts_max>0.007867813110351562</time_between_pkts_max><time_between_pkts_min>0.007867813110351562</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4530811933081928</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4530811933081928</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>199</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>199</min_tcp_pkts><max_tcp_pkts>199</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="26"><ip.session_id>14</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.2070369720458984</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.45309617041576394</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.45309617041576394</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="27"><ip.session_id>14</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.2071170806884766</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.007152557373046875</time_between_pkts_sum><time_between_pkts_avg>0.007152557373046875</time_between_pkts_avg><time_between_pkts_max>0.007152557373046875</time_between_pkts_max><time_between_pkts_min>0.007152557373046875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4530797250176077</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4530797250176077</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1720</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1720</min_tcp_pkts><max_tcp_pkts>1720</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="28"><ip.session_id>15</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.2070369720458984</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.45309617041576394</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.45309617041576394</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="29"><ip.session_id>15</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.207119941711426</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.00286102294921875</time_between_pkts_sum><time_between_pkts_avg>0.00286102294921875</time_between_pkts_avg><time_between_pkts_max>0.00286102294921875</time_between_pkts_max><time_between_pkts_min>0.00286102294921875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4530791377040383</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4530791377040383</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>23</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>23</min_tcp_pkts><max_tcp_pkts>23</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="30"><ip.session_id>16</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.2372870445251465</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.30994415283203125</time_between_pkts_sum><time_between_pkts_avg>0.30994415283203125</time_between_pkts_avg><time_between_pkts_max>0.30994415283203125</time_between_pkts_max><time_between_pkts_min>0.30994415283203125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.446969914945467</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.446969914945467</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="31"><ip.session_id>16</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.2373011112213135</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.014066696166992188</time_between_pkts_sum><time_between_pkts_avg>0.014066696166992188</time_between_pkts_avg><time_between_pkts_max>0.014066696166992188</time_between_pkts_max><time_between_pkts_min>0.014066696166992188</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.44696710468896744</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.44696710468896744</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>8888</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>8888</min_tcp_pkts><max_tcp_pkts>8888</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="32"><ip.session_id>17</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.2373080253601074</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.44696572338940427</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.44696572338940427</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="33"><ip.session_id>17</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.237313985824585</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.44696453262077107</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.44696453262077107</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>995</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>995</min_tcp_pkts><max_tcp_pkts>995</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="34"><ip.session_id>18</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.2373669147491455</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.052928924560546875</time_between_pkts_sum><time_between_pkts_avg>0.052928924560546875</time_between_pkts_avg><time_between_pkts_max>0.052928924560546875</time_between_pkts_max><time_between_pkts_min>0.052928924560546875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.44695395887362555</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.44695395887362555</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="35"><ip.session_id>18</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.2373769283294678</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.010013580322265625</time_between_pkts_sum><time_between_pkts_avg>0.010013580322265625</time_between_pkts_avg><time_between_pkts_max>0.010013580322265625</time_between_pkts_max><time_between_pkts_min>0.010013580322265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.44695195849125324</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.44695195849125324</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>143</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>143</min_tcp_pkts><max_tcp_pkts>143</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="36"><ip.session_id>19</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.2373669147491455</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.44695395887362555</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.44695395887362555</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="37"><ip.session_id>19</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.237384080886841</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.007152557373046875</time_between_pkts_sum><time_between_pkts_avg>0.007152557373046875</time_between_pkts_avg><time_between_pkts_max>0.007152557373046875</time_between_pkts_max><time_between_pkts_min>0.007152557373046875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.44695052965766435</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.44695052965766435</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>110</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>110</min_tcp_pkts><max_tcp_pkts>110</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="38"><ip.session_id>20</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.2376420497894287</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.2579689025878906</time_between_pkts_sum><time_between_pkts_avg>0.2579689025878906</time_between_pkts_avg><time_between_pkts_max>0.2579689025878906</time_between_pkts_max><time_between_pkts_min>0.2579689025878906</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4468990024986812</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4468990024986812</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="39"><ip.session_id>20</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.2376489639282227</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.446897621620009</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.446897621620009</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>25</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>25</min_tcp_pkts><max_tcp_pkts>25</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="40"><ip.session_id>21</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.237661123275757</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.012159347534179688</time_between_pkts_sum><time_between_pkts_avg>0.012159347534179688</time_between_pkts_avg><time_between_pkts_max>0.012159347534179688</time_between_pkts_max><time_between_pkts_min>0.012159347534179688</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.44689519319890586</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.44689519319890586</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="41"><ip.session_id>21</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.2376670837402344</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.44689400280604374</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.44689400280604374</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>554</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>554</min_tcp_pkts><max_tcp_pkts>554</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="42"><ip.session_id>22</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.2378649711608887</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.19788742065429688</time_between_pkts_sum><time_between_pkts_avg>0.19788742065429688</time_between_pkts_avg><time_between_pkts_max>0.19788742065429688</time_between_pkts_max><time_between_pkts_min>0.19788742065429688</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.44685448536300726</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.44685448536300726</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="43"><ip.session_id>22</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.2378721237182617</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.007152557373046875</time_between_pkts_sum><time_between_pkts_avg>0.007152557373046875</time_between_pkts_avg><time_between_pkts_max>0.007152557373046875</time_between_pkts_max><time_between_pkts_min>0.007152557373046875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.44685305715256124</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.44685305715256124</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>21</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>21</min_tcp_pkts><max_tcp_pkts>21</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="44"><ip.session_id>23</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.2381250858306885</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.2529621124267578</time_between_pkts_sum><time_between_pkts_avg>0.2529621124267578</time_between_pkts_avg><time_between_pkts_max>0.2529621124267578</time_between_pkts_max><time_between_pkts_min>0.2529621124267578</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4468025519801751</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4468025519801751</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="45"><ip.session_id>23</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.238132953643799</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.007867813110351562</time_between_pkts_sum><time_between_pkts_avg>0.007867813110351562</time_between_pkts_avg><time_between_pkts_max>0.007867813110351562</time_between_pkts_max><time_between_pkts_min>0.007867813110351562</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4468009813143348</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4468009813143348</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>135</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>135</min_tcp_pkts><max_tcp_pkts>135</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="46"><ip.session_id>24</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>2</ip.pkts_per_flow><duration>2.2686269283294678</duration><ip.header_len>40</ip.header_len><ip.payload_len>44</ip.payload_len><ip.avg_bytes_tot_len>42.666666666666664</ip.avg_bytes_tot_len><time_between_pkts_sum>30.221939086914062</time_between_pkts_sum><time_between_pkts_avg>15.110969543457031</time_between_pkts_avg><time_between_pkts_max>30.215978622436523</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>21.36170869926153</time_between_pkts_std><(-0.001, 50.0]>2</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>2</tcp_pkts_per_flow><pkts_rate>0.8815905228951528</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.8815905228951528</byte_rate><tcp.tcp_session_payload_up_len>2</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>2</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>2</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>2</sport_g><sport_le>0</sport_le><dport_g>2</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="47"><ip.session_id>24</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.238176107406616</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.666666666666664</ip.avg_bytes_tot_len><time_between_pkts_sum>0.03719329833984375</time_between_pkts_sum><time_between_pkts_avg>0.03719329833984375</time_between_pkts_avg><time_between_pkts_max>0.03719329833984375</time_between_pkts_max><time_between_pkts_min>0.03719329833984375</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4467923666465657</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4467923666465657</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>8080</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>8080</min_tcp_pkts><max_tcp_pkts>8080</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="48"><ip.session_id>25</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.238187074661255</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.010967254638671875</time_between_pkts_sum><time_between_pkts_avg>0.010967254638671875</time_between_pkts_avg><time_between_pkts_max>0.010967254638671875</time_between_pkts_max><time_between_pkts_min>0.010967254638671875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4467901773364266</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4467901773364266</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="49"><ip.session_id>25</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.2381980419158936</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.010967254638671875</time_between_pkts_sum><time_between_pkts_avg>0.010967254638671875</time_between_pkts_avg><time_between_pkts_max>0.010967254638671875</time_between_pkts_max><time_between_pkts_min>0.010967254638671875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.446787988047743</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.446787988047743</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>113</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>113</min_tcp_pkts><max_tcp_pkts>113</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="50"><ip.session_id>26</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.238187074661255</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4467901773364266</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4467901773364266</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="51"><ip.session_id>26</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.2382049560546875</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4467866078550343</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4467866078550343</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>53</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>53</min_tcp_pkts><max_tcp_pkts>53</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="52"><ip.session_id>27</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.2382090091705322</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0040531158447265625</time_between_pkts_sum><time_between_pkts_avg>0.0040531158447265625</time_between_pkts_avg><time_between_pkts_max>0.0040531158447265625</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.44678579878051444</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.44678579878051444</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="53"><ip.session_id>27</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.2382140159606934</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.44678479933956483</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.44678479933956483</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>80</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>80</min_tcp_pkts><max_tcp_pkts>80</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="54"><ip.session_id>28</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.238219976425171</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.44678360953474067</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.44678360953474067</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="55"><ip.session_id>28</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.238224983215332</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.44678261010358555</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.44678261010358555</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>3389</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>3389</min_tcp_pkts><max_tcp_pkts>3389</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="56"><ip.session_id>29</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.2382779121398926</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.052928924560546875</time_between_pkts_sum><time_between_pkts_avg>0.052928924560546875</time_between_pkts_avg><time_between_pkts_max>0.052928924560546875</time_between_pkts_max><time_between_pkts_min>0.052928924560546875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.446772044961993</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.446772044961993</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="57"><ip.session_id>29</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.2382869720458984</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.009059906005859375</time_between_pkts_sum><time_between_pkts_avg>0.009059906005859375</time_between_pkts_avg><time_between_pkts_max>0.009059906005859375</time_between_pkts_max><time_between_pkts_min>0.009059906005859375</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4467702365644176</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4467702365644176</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>111</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>111</min_tcp_pkts><max_tcp_pkts>111</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="58"><ip.session_id>30</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.2382779121398926</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.446772044961993</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.446772044961993</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="59"><ip.session_id>30</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.2382941246032715</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.007152557373046875</time_between_pkts_sum><time_between_pkts_avg>0.007152557373046875</time_between_pkts_avg><time_between_pkts_max>0.007152557373046875</time_between_pkts_max><time_between_pkts_min>0.007152557373046875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.44676880889246223</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.44676880889246223</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1025</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1025</min_tcp_pkts><max_tcp_pkts>1025</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="60"><ip.session_id>31</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.238297939300537</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.003814697265625</time_between_pkts_sum><time_between_pkts_avg>0.003814697265625</time_between_pkts_avg><time_between_pkts_max>0.003814697265625</time_between_pkts_max><time_between_pkts_min>0.003814697265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4467680474711502</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4467680474711502</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="61"><ip.session_id>31</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.2383029460906982</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4467670481096168</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4467670481096168</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>587</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>587</min_tcp_pkts><max_tcp_pkts>587</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="62"><ip.session_id>32</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.2383430004119873</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0400543212890625</time_between_pkts_sum><time_between_pkts_avg>0.0400543212890625</time_between_pkts_avg><time_between_pkts_max>0.0400543212890625</time_between_pkts_max><time_between_pkts_min>0.0400543212890625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4467590533782986</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4467590533782986</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="63"><ip.session_id>32</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.2383530139923096</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.010013580322265625</time_between_pkts_sum><time_between_pkts_avg>0.010013580322265625</time_between_pkts_avg><time_between_pkts_max>0.010013580322265625</time_between_pkts_max><time_between_pkts_min>0.010013580322265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4467570547401759</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4467570547401759</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>256</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>256</min_tcp_pkts><max_tcp_pkts>256</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="64"><ip.session_id>33</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.2383430004119873</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4467590533782986</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4467590533782986</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="65"><ip.session_id>33</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.2383599281311035</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.44675567473857525</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.44675567473857525</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>139</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>139</min_tcp_pkts><max_tcp_pkts>139</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="66"><ip.session_id>34</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.2383430004119873</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4467590533782986</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4467590533782986</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="67"><ip.session_id>34</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.238363027572632</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0030994415283203125</time_between_pkts_sum><time_between_pkts_avg>0.0030994415283203125</time_between_pkts_avg><time_between_pkts_max>0.0030994415283203125</time_between_pkts_max><time_between_pkts_min>0.0030994415283203125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.44675505611993555</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.44675505611993555</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1036</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1036</min_tcp_pkts><max_tcp_pkts>1036</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="68"><ip.session_id>35</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.2384040355682373</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.04100799560546875</time_between_pkts_sum><time_between_pkts_avg>0.04100799560546875</time_between_pkts_avg><time_between_pkts_max>0.04100799560546875</time_between_pkts_max><time_between_pkts_min>0.04100799560546875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.44674687148075204</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.44674687148075204</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="69"><ip.session_id>35</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.2384109497070312</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.44674549154206133</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.44674549154206133</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>6881</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>6881</min_tcp_pkts><max_tcp_pkts>6881</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="70"><ip.session_id>36</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.2688779830932617</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.2510547637939453</time_between_pkts_sum><time_between_pkts_avg>0.2510547637939453</time_between_pkts_avg><time_between_pkts_max>0.2510547637939453</time_between_pkts_max><time_between_pkts_min>0.2510547637939453</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.44074648678844147</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.44074648678844147</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="71"><ip.session_id>36</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.2688848972320557</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.44074514366945544</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.44074514366945544</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>6003</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>6003</min_tcp_pkts><max_tcp_pkts>6003</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="72"><ip.session_id>37</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.268965005874634</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.080108642578125</time_between_pkts_sum><time_between_pkts_avg>0.080108642578125</time_between_pkts_avg><time_between_pkts_max>0.080108642578125</time_between_pkts_max><time_between_pkts_min>0.080108642578125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4407295826118407</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4407295826118407</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="73"><ip.session_id>37</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.2689709663391113</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.44072842483897345</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.44072842483897345</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>10000</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>10000</min_tcp_pkts><max_tcp_pkts>10000</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="74"><ip.session_id>38</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.2690839767456055</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.11301040649414062</time_between_pkts_sum><time_between_pkts_avg>0.11301040649414062</time_between_pkts_avg><time_between_pkts_max>0.11301040649414062</time_between_pkts_max><time_between_pkts_min>0.11301040649414062</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4407064746163484</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4407064746163484</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="75"><ip.session_id>38</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.269089937210083</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.44070531696488474</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.44070531696488474</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>465</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>465</min_tcp_pkts><max_tcp_pkts>465</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="76"><ip.session_id>39</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.2691760063171387</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.08606910705566406</time_between_pkts_sum><time_between_pkts_avg>0.08606910705566406</time_between_pkts_avg><time_between_pkts_max>0.08606910705566406</time_between_pkts_max><time_between_pkts_min>0.08606910705566406</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.44068860115570985</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.44068860115570985</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="77"><ip.session_id>39</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.2691850662231445</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.009059906005859375</time_between_pkts_sum><time_between_pkts_avg>0.009059906005859375</time_between_pkts_avg><time_between_pkts_max>0.009059906005859375</time_between_pkts_max><time_between_pkts_min>0.009059906005859375</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4406868416706137</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4406868416706137</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>3052</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>3052</min_tcp_pkts><max_tcp_pkts>3052</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="78"><ip.session_id>40</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.2691760063171387</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.44068860115570985</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.44068860115570985</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="79"><ip.session_id>40</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.269191026687622</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4406856841222916</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4406856841222916</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>5801</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>5801</min_tcp_pkts><max_tcp_pkts>5801</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="80"><ip.session_id>41</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.269649028778076</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.45800209045410156</time_between_pkts_sum><time_between_pkts_avg>0.45800209045410156</time_between_pkts_avg><time_between_pkts_max>0.45800209045410156</time_between_pkts_max><time_between_pkts_min>0.45800209045410156</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4405967562915997</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4405967562915997</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="81"><ip.session_id>41</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.2696549892425537</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.44059559921648156</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.44059559921648156</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>3260</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>3260</min_tcp_pkts><max_tcp_pkts>3260</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="82"><ip.session_id>42</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.2697269916534424</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.07200241088867188</time_between_pkts_sum><time_between_pkts_avg>0.07200241088867188</time_between_pkts_avg><time_between_pkts_max>0.07200241088867188</time_between_pkts_max><time_between_pkts_min>0.07200241088867188</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.44058162222916675</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.44058162222916675</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="83"><ip.session_id>42</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.269737958908081</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.010967254638671875</time_between_pkts_sum><time_between_pkts_avg>0.010967254638671875</time_between_pkts_avg><time_between_pkts_max>0.010967254638671875</time_between_pkts_max><time_between_pkts_min>0.010967254638671875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.44057949336190205</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.44057949336190205</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>24800</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>24800</min_tcp_pkts><max_tcp_pkts>24800</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="84"><ip.session_id>43</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.269745111465454</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.007152557373046875</time_between_pkts_sum><time_between_pkts_avg>0.007152557373046875</time_between_pkts_avg><time_between_pkts_max>0.007152557373046875</time_between_pkts_max><time_between_pkts_min>0.007152557373046875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4405781049812915</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4405781049812915</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="85"><ip.session_id>43</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.2697529792785645</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.007867813110351562</time_between_pkts_sum><time_between_pkts_avg>0.007867813110351562</time_between_pkts_avg><time_between_pkts_max>0.007867813110351562</time_between_pkts_max><time_between_pkts_min>0.007867813110351562</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.44057657777272646</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.44057657777272646</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>5190</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>5190</min_tcp_pkts><max_tcp_pkts>5190</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="86"><ip.session_id>44</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.269779920578003</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.026941299438476562</time_between_pkts_sum><time_between_pkts_avg>0.026941299438476562</time_between_pkts_avg><time_between_pkts_max>0.026941299438476562</time_between_pkts_max><time_between_pkts_min>0.026941299438476562</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4405713483205669</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4405713483205669</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="87"><ip.session_id>44</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.269787073135376</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.007152557373046875</time_between_pkts_sum><time_between_pkts_avg>0.007152557373046875</time_between_pkts_avg><time_between_pkts_max>0.007152557373046875</time_between_pkts_max><time_between_pkts_min>0.007152557373046875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.44056995999129006</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.44056995999129006</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>5269</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>5269</min_tcp_pkts><max_tcp_pkts>5269</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="88"><ip.session_id>45</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.2698960304260254</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.10895729064941406</time_between_pkts_sum><time_between_pkts_avg>0.10895729064941406</time_between_pkts_avg><time_between_pkts_max>0.10895729064941406</time_between_pkts_max><time_between_pkts_min>0.10895729064941406</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.44054881219044867</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.44054881219044867</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="89"><ip.session_id>45</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.2699050903320312</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.009059906005859375</time_between_pkts_sum><time_between_pkts_avg>0.009059906005859375</time_between_pkts_avg><time_between_pkts_max>0.009059906005859375</time_between_pkts_max><time_between_pkts_min>0.009059906005859375</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4405470538214109</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4405470538214109</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>7911</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>7911</min_tcp_pkts><max_tcp_pkts>7911</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="90"><ip.session_id>46</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.2698960304260254</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.44054881219044867</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.44054881219044867</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="91"><ip.session_id>46</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.269911050796509</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.44054589700733043</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.44054589700733043</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1138</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1138</min_tcp_pkts><max_tcp_pkts>1138</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="92"><ip.session_id>47</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.269913911819458</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.00286102294921875</time_between_pkts_sum><time_between_pkts_avg>0.00286102294921875</time_between_pkts_avg><time_between_pkts_max>0.00286102294921875</time_between_pkts_max><time_between_pkts_min>0.00286102294921875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4405453417387298</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4405453417387298</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="93"><ip.session_id>47</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.269918918609619</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4405443700220466</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4405443700220466</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>32774</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>32774</min_tcp_pkts><max_tcp_pkts>32774</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="94"><ip.session_id>48</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.269947052001953</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.028133392333984375</time_between_pkts_sum><time_between_pkts_avg>0.028133392333984375</time_between_pkts_avg><time_between_pkts_max>0.028133392333984375</time_between_pkts_max><time_between_pkts_min>0.028133392333984375</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4405389099794472</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4405389099794472</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="95"><ip.session_id>48</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.2699520587921143</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4405379382911371</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4405379382911371</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>2100</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>2100</min_tcp_pkts><max_tcp_pkts>2100</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="96"><ip.session_id>49</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.269994020462036</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.041961669921875</time_between_pkts_sum><time_between_pkts_avg>0.041961669921875</time_between_pkts_avg><time_between_pkts_max>0.041961669921875</time_between_pkts_max><time_between_pkts_min>0.041961669921875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.44052979478618154</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.44052979478618154</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="97"><ip.session_id>49</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.2699999809265137</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.44052863806273873</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.44052863806273873</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>2161</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>2161</min_tcp_pkts><max_tcp_pkts>2161</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="98"><ip.session_id>50</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.270008087158203</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.008106231689453125</time_between_pkts_sum><time_between_pkts_avg>0.008106231689453125</time_between_pkts_avg><time_between_pkts_max>0.008106231689453125</time_between_pkts_max><time_between_pkts_min>0.008106231689453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.44052706492860494</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.44052706492860494</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="99"><ip.session_id>50</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.2700130939483643</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4405260932925468</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4405260932925468</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>32785</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>32785</min_tcp_pkts><max_tcp_pkts>32785</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="100"><ip.session_id>51</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.270033121109009</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.02002716064453125</time_between_pkts_sum><time_between_pkts_avg>0.02002716064453125</time_between_pkts_avg><time_between_pkts_max>0.02002716064453125</time_between_pkts_max><time_between_pkts_min>0.02002716064453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4405222067911754</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4405222067911754</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="101"><ip.session_id>51</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.2700459957122803</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.012874603271484375</time_between_pkts_sum><time_between_pkts_avg>0.012874603271484375</time_between_pkts_avg><time_between_pkts_max>0.012874603271484375</time_between_pkts_max><time_between_pkts_min>0.012874603271484375</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.44051970836222043</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.44051970836222043</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>57294</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>57294</min_tcp_pkts><max_tcp_pkts>57294</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="102"><ip.session_id>52</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.2700600624084473</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.014066696166992188</time_between_pkts_sum><time_between_pkts_avg>0.014066696166992188</time_between_pkts_avg><time_between_pkts_max>0.014066696166992188</time_between_pkts_max><time_between_pkts_min>0.014066696166992188</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4405169786296483</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4405169786296483</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="103"><ip.session_id>52</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.270066022872925</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4405158219735086</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4405158219735086</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>42</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>42</min_tcp_pkts><max_tcp_pkts>42</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="104"><ip.session_id>53</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.270113945007324</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.04792213439941406</time_between_pkts_sum><time_between_pkts_avg>0.04792213439941406</time_between_pkts_avg><time_between_pkts_max>0.04792213439941406</time_between_pkts_max><time_between_pkts_min>0.04792213439941406</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4405065226788753</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4405065226788753</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="105"><ip.session_id>53</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.2701199054718018</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.44050536607764285</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.44050536607764285</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1687</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1687</min_tcp_pkts><max_tcp_pkts>1687</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="106"><ip.session_id>54</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.270211935043335</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.09202957153320312</time_between_pkts_sum><time_between_pkts_avg>0.09202957153320312</time_between_pkts_avg><time_between_pkts_max>0.09202957153320312</time_between_pkts_max><time_between_pkts_min>0.09202957153320312</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.44048750892542177</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.44048750892542177</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="107"><ip.session_id>54</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.2702178955078125</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4404863524240326</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4404863524240326</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>2393</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>2393</min_tcp_pkts><max_tcp_pkts>2393</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="108"><ip.session_id>55</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.27024507522583</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.027179718017578125</time_between_pkts_sum><time_between_pkts_avg>0.027179718017578125</time_between_pkts_avg><time_between_pkts_max>0.027179718017578125</time_between_pkts_max><time_between_pkts_min>0.027179718017578125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.44048107885468096</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.44048107885468096</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="109"><ip.session_id>55</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.270251989364624</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.44047973735279944</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.44047973735279944</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1213</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1213</min_tcp_pkts><max_tcp_pkts>1213</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="110"><ip.session_id>56</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.27024507522583</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.44048107885468096</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.44048107885468096</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="111"><ip.session_id>56</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.270258903503418</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.44047839585908904</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.44047839585908904</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>3211</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>3211</min_tcp_pkts><max_tcp_pkts>3211</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="112"><ip.session_id>57</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.2702910900115967</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.03218650817871094</time_between_pkts_sum><time_between_pkts_avg>0.03218650817871094</time_between_pkts_avg><time_between_pkts_max>0.03218650817871094</time_between_pkts_max><time_between_pkts_min>0.03218650817871094</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4404721510821293</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4404721510821293</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="113"><ip.session_id>57</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.270298957824707</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.007867813110351562</time_between_pkts_sum><time_between_pkts_avg>0.007867813110351562</time_between_pkts_avg><time_between_pkts_max>0.007867813110351562</time_between_pkts_max><time_between_pkts_min>0.007867813110351562</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4404706246080264</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4404706246080264</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>9877</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>9877</min_tcp_pkts><max_tcp_pkts>9877</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="114"><ip.session_id>58</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.2702910900115967</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4404721510821293</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4404721510821293</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="115"><ip.session_id>58</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.27030611038208</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.007152557373046875</time_between_pkts_sum><time_between_pkts_avg>0.007152557373046875</time_between_pkts_avg><time_between_pkts_max>0.007152557373046875</time_between_pkts_max><time_between_pkts_min>0.007152557373046875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4404692369134775</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4404692369134775</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>2013</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>2013</min_tcp_pkts><max_tcp_pkts>2013</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="116"><ip.session_id>59</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.270308017730713</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0019073486328125</time_between_pkts_sum><time_between_pkts_avg>0.0019073486328125</time_between_pkts_avg><time_between_pkts_max>0.0019073486328125</time_between_pkts_max><time_between_pkts_min>0.0019073486328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4404688668630745</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4404688668630745</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="117"><ip.session_id>59</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.270313024520874</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.440467895483725</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.440467895483725</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>6543</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>6543</min_tcp_pkts><max_tcp_pkts>6543</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="118"><ip.session_id>60</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.270505905151367</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.19288063049316406</time_between_pkts_sum><time_between_pkts_avg>0.19288063049316406</time_between_pkts_avg><time_between_pkts_max>0.19288063049316406</time_between_pkts_max><time_between_pkts_min>0.19288063049316406</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4404304775121619</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4404304775121619</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="119"><ip.session_id>60</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.2705230712890625</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0171661376953125</time_between_pkts_sum><time_between_pkts_avg>0.0171661376953125</time_between_pkts_avg><time_between_pkts_max>0.0171661376953125</time_between_pkts_max><time_between_pkts_min>0.0171661376953125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.44042714766701835</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.44042714766701835</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>3261</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>3261</min_tcp_pkts><max_tcp_pkts>3261</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="120"><ip.session_id>61</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.270505905151367</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4404304775121619</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4404304775121619</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="121"><ip.session_id>61</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.27052903175354</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4404259914825645</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4404259914825645</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>8093</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>8093</min_tcp_pkts><max_tcp_pkts>8093</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="122"><ip.session_id>62</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.270505905151367</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4404304775121619</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4404304775121619</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="123"><ip.session_id>62</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.270534038543701</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.44042502029231434</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.44042502029231434</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>8088</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>8088</min_tcp_pkts><max_tcp_pkts>8088</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="124"><ip.session_id>63</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.270505905151367</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4404304775121619</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4404304775121619</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="125"><ip.session_id>63</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.2705368995666504</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.00286102294921875</time_between_pkts_sum><time_between_pkts_avg>0.00286102294921875</time_between_pkts_avg><time_between_pkts_max>0.00286102294921875</time_between_pkts_max><time_between_pkts_min>0.00286102294921875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.44042446532838014</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.44042446532838014</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>2045</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>2045</min_tcp_pkts><max_tcp_pkts>2045</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="126"><ip.session_id>64</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.270505905151367</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4404304775121619</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4404304775121619</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="127"><ip.session_id>64</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.2705399990081787</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0030994415283203125</time_between_pkts_sum><time_between_pkts_avg>0.0030994415283203125</time_between_pkts_avg><time_between_pkts_max>0.0030994415283203125</time_between_pkts_max><time_between_pkts_min>0.0030994415283203125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.44042386411902973</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.44042386411902973</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1111</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1111</min_tcp_pkts><max_tcp_pkts>1111</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="128"><ip.session_id>65</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.270505905151367</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4404304775121619</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4404304775121619</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="129"><ip.session_id>65</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.270543098449707</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0030994415283203125</time_between_pkts_sum><time_between_pkts_avg>0.0030994415283203125</time_between_pkts_avg><time_between_pkts_max>0.0030994415283203125</time_between_pkts_max><time_between_pkts_min>0.0030994415283203125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.44042326291132067</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.44042326291132067</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>683</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>683</min_tcp_pkts><max_tcp_pkts>683</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="130"><ip.session_id>66</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.270505905151367</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4404304775121619</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4404304775121619</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="131"><ip.session_id>66</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.270548105239868</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4404222917331041</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4404222917331041</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>8008</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>8008</min_tcp_pkts><max_tcp_pkts>8008</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="132"><ip.session_id>67</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.270505905151367</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4404304775121619</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4404304775121619</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="133"><ip.session_id>67</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.270550012588501</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0019073486328125</time_between_pkts_sum><time_between_pkts_avg>0.0019073486328125</time_between_pkts_avg><time_between_pkts_max>0.0019073486328125</time_between_pkts_max><time_between_pkts_min>0.0019073486328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4404219217615768</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4404219217615768</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>85</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>85</min_tcp_pkts><max_tcp_pkts>85</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="134"><ip.session_id>68</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.2705540657043457</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0040531158447265625</time_between_pkts_sum><time_between_pkts_avg>0.0040531158447265625</time_between_pkts_avg><time_between_pkts_max>0.0040531158447265625</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4404211355741451</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4404211355741451</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="135"><ip.session_id>68</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.2705719470977783</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.017881393432617188</time_between_pkts_sum><time_between_pkts_avg>0.017881393432617188</time_between_pkts_avg><time_between_pkts_max>0.017881393432617188</time_between_pkts_max><time_between_pkts_min>0.017881393432617188</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.44041766713368835</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.44041766713368835</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>648</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>648</min_tcp_pkts><max_tcp_pkts>648</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="136"><ip.session_id>69</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.2705540657043457</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4404211355741451</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4404211355741451</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="137"><ip.session_id>69</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.270577907562256</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4404165109990094</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4404165109990094</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>5226</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>5226</min_tcp_pkts><max_tcp_pkts>5226</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="138"><ip.session_id>70</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.2705540657043457</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4404211355741451</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4404211355741451</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="139"><ip.session_id>70</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.270581007003784</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0030994415283203125</time_between_pkts_sum><time_between_pkts_avg>0.0030994415283203125</time_between_pkts_avg><time_between_pkts_max>0.0030994415283203125</time_between_pkts_max><time_between_pkts_min>0.0030994415283203125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4404159098113752</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4404159098113752</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>212</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>212</min_tcp_pkts><max_tcp_pkts>212</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="140"><ip.session_id>71</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.2705540657043457</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4404211355741451</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4404211355741451</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="141"><ip.session_id>71</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.2705841064453125</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0030994415283203125</time_between_pkts_sum><time_between_pkts_avg>0.0030994415283203125</time_between_pkts_avg><time_between_pkts_max>0.0030994415283203125</time_between_pkts_max><time_between_pkts_min>0.0030994415283203125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4404153086253822</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4404153086253822</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>9220</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>9220</min_tcp_pkts><max_tcp_pkts>9220</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="142"><ip.session_id>72</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.270585060119629</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.00095367431640625</time_between_pkts_sum><time_between_pkts_avg>0.00095367431640625</time_between_pkts_avg><time_between_pkts_max>0.00095367431640625</time_between_pkts_max><time_between_pkts_min>0.00095367431640625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4404151236454069</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4404151236454069</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="143"><ip.session_id>72</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.270595073699951</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.010013580322265625</time_between_pkts_sum><time_between_pkts_avg>0.010013580322265625</time_between_pkts_avg><time_between_pkts_max>0.010013580322265625</time_between_pkts_max><time_between_pkts_min>0.010013580322265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4404131813650475</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4404131813650475</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>3493</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>3493</min_tcp_pkts><max_tcp_pkts>3493</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="144"><ip.session_id>73</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.2706010341644287</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4404120252539194</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4404120252539194</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="145"><ip.session_id>73</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.2706050872802734</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0040531158447265625</time_between_pkts_sum><time_between_pkts_avg>0.0040531158447265625</time_between_pkts_avg><time_between_pkts_max>0.0040531158447265625</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4404112391018194</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4404112391018194</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>6129</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>6129</min_tcp_pkts><max_tcp_pkts>6129</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="146"><ip.session_id>74</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.270638942718506</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.033855438232421875</time_between_pkts_sum><time_between_pkts_avg>0.033855438232421875</time_between_pkts_avg><time_between_pkts_max>0.033855438232421875</time_between_pkts_max><time_between_pkts_min>0.033855438232421875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4404046725292033</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4404046725292033</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="147"><ip.session_id>74</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.2706449031829834</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.44040351646274717</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.44040351646274717</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1805</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1805</min_tcp_pkts><max_tcp_pkts>1805</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="148"><ip.session_id>75</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.270656108856201</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.011205673217773438</time_between_pkts_sum><time_between_pkts_avg>0.011205673217773438</time_between_pkts_avg><time_between_pkts_max>0.011205673217773438</time_between_pkts_max><time_between_pkts_min>0.011205673217773438</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.44040134307424056</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.44040134307424056</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="149"><ip.session_id>75</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.2706611156463623</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.44040037199269244</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.44040037199269244</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>9080</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>9080</min_tcp_pkts><max_tcp_pkts>9080</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="150"><ip.session_id>76</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.301896095275879</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>31.2349796295166</time_between_pkts_sum><time_between_pkts_avg>31.2349796295166</time_between_pkts_avg><time_between_pkts_max>31.2349796295166</time_between_pkts_max><time_between_pkts_min>31.2349796295166</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.43442447382932436</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.43442447382932436</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="151"><ip.session_id>76</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.301927089691162</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.030994415283203125</time_between_pkts_sum><time_between_pkts_avg>0.030994415283203125</time_between_pkts_avg><time_between_pkts_max>0.030994415283203125</time_between_pkts_max><time_between_pkts_min>0.030994415283203125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4344186244987303</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4344186244987303</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>9500</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>9500</min_tcp_pkts><max_tcp_pkts>9500</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="152"><ip.session_id>77</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.302030086517334</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.102996826171875</time_between_pkts_sum><time_between_pkts_avg>0.102996826171875</time_between_pkts_avg><time_between_pkts_max>0.102996826171875</time_between_pkts_max><time_between_pkts_min>0.102996826171875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.43439918785460674</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.43439918785460674</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="153"><ip.session_id>77</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3020379543304443</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.007867813110351562</time_between_pkts_sum><time_between_pkts_avg>0.007867813110351562</time_between_pkts_avg><time_between_pkts_max>0.007867813110351562</time_between_pkts_max><time_between_pkts_min>0.007867813110351562</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4343977031824627</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4343977031824627</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>49154</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>49154</min_tcp_pkts><max_tcp_pkts>49154</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="154"><ip.session_id>78</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.302199125289917</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.16117095947265625</time_between_pkts_sum><time_between_pkts_avg>0.16117095947265625</time_between_pkts_avg><time_between_pkts_max>0.16117095947265625</time_between_pkts_max><time_between_pkts_min>0.16117095947265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.43436729213163505</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.43436729213163505</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="155"><ip.session_id>78</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3022100925445557</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.010967254638671875</time_between_pkts_sum><time_between_pkts_avg>0.010967254638671875</time_between_pkts_avg><time_between_pkts_max>0.010967254638671875</time_between_pkts_max><time_between_pkts_min>0.010967254638671875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4343652228953325</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4343652228953325</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>9111</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>9111</min_tcp_pkts><max_tcp_pkts>9111</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="156"><ip.session_id>79</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.302199125289917</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.43436729213163505</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.43436729213163505</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="157"><ip.session_id>79</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.302216053009033</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4343640983186543</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4343640983186543</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>7676</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>7676</min_tcp_pkts><max_tcp_pkts>7676</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="158"><ip.session_id>80</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.302220106124878</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0040531158447265625</time_between_pkts_sum><time_between_pkts_avg>0.0040531158447265625</time_between_pkts_avg><time_between_pkts_max>0.0040531158447265625</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4343633336098393</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4343633336098393</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="159"><ip.session_id>80</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3022239208221436</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.003814697265625</time_between_pkts_sum><time_between_pkts_avg>0.003814697265625</time_between_pkts_avg><time_between_pkts_max>0.003814697265625</time_between_pkts_max><time_between_pkts_min>0.003814697265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4343626138863554</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4343626138863554</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>6001</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>6001</min_tcp_pkts><max_tcp_pkts>6001</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="160"><ip.session_id>81</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3022570610046387</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.03314018249511719</time_between_pkts_sum><time_between_pkts_avg>0.03314018249511719</time_between_pkts_avg><time_between_pkts_max>0.03314018249511719</time_between_pkts_max><time_between_pkts_min>0.03314018249511719</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.43435636138895317</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.43435636138895317</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="161"><ip.session_id>81</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.302263021469116</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4343552368581595</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4343552368581595</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>32769</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>32769</min_tcp_pkts><max_tcp_pkts>32769</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="162"><ip.session_id>82</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3022570610046387</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.43435636138895317</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.43435636138895317</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="163"><ip.session_id>82</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3022689819335938</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4343541123331886</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4343541123331886</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>5862</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>5862</min_tcp_pkts><max_tcp_pkts>5862</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="164"><ip.session_id>83</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.302294969558716</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.025987625122070312</time_between_pkts_sum><time_between_pkts_avg>0.025987625122070312</time_between_pkts_avg><time_between_pkts_max>0.025987625122070312</time_between_pkts_max><time_between_pkts_min>0.025987625122070312</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4343492094723516</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4343492094723516</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="165"><ip.session_id>83</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3023009300231934</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4343480849785897</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4343480849785897</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>2875</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>2875</min_tcp_pkts><max_tcp_pkts>2875</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="166"><ip.session_id>84</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3023910522460938</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.09012222290039062</time_between_pkts_sum><time_between_pkts_avg>0.09012222290039062</time_between_pkts_avg><time_between_pkts_max>0.09012222290039062</time_between_pkts_max><time_between_pkts_min>0.09012222290039062</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.43433108334244597</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.43433108334244597</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="167"><ip.session_id>84</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.302424907684326</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.033855438232421875</time_between_pkts_sum><time_between_pkts_avg>0.033855438232421875</time_between_pkts_avg><time_between_pkts_max>0.033855438232421875</time_between_pkts_max><time_between_pkts_min>0.033855438232421875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4343246968283341</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4343246968283341</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>8031</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>8031</min_tcp_pkts><max_tcp_pkts>8031</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="168"><ip.session_id>85</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.302432060241699</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.007152557373046875</time_between_pkts_sum><time_between_pkts_avg>0.007152557373046875</time_between_pkts_avg><time_between_pkts_max>0.007152557373046875</time_between_pkts_max><time_between_pkts_min>0.007152557373046875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4343233475888207</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4343233475888207</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="169"><ip.session_id>85</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3024380207061768</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4343222232289631</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4343222232289631</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>2010</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>2010</min_tcp_pkts><max_tcp_pkts>2010</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="170"><ip.session_id>86</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3024539947509766</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.015974044799804688</time_between_pkts_sum><time_between_pkts_avg>0.015974044799804688</time_between_pkts_avg><time_between_pkts_max>0.015974044799804688</time_between_pkts_max><time_between_pkts_min>0.015974044799804688</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.434319209973251</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.434319209973251</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="171"><ip.session_id>86</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3024590015411377</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.43431826552857433</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.43431826552857433</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>6007</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>6007</min_tcp_pkts><max_tcp_pkts>6007</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="172"><ip.session_id>87</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.302541971206665</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.08296966552734375</time_between_pkts_sum><time_between_pkts_avg>0.08296966552734375</time_between_pkts_avg><time_between_pkts_max>0.08296966552734375</time_between_pkts_max><time_between_pkts_min>0.08296966552734375</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.43430261532906705</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.43430261532906705</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="173"><ip.session_id>87</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3025479316711426</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.43430149107654853</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.43430149107654853</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>11967</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>11967</min_tcp_pkts><max_tcp_pkts>11967</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="174"><ip.session_id>88</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3025929927825928</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.04506111145019531</time_between_pkts_sum><time_between_pkts_avg>0.04506111145019531</time_between_pkts_avg><time_between_pkts_max>0.04506111145019531</time_between_pkts_max><time_between_pkts_min>0.04506111145019531</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4342929919158398</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4342929919158398</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="175"><ip.session_id>88</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3025989532470703</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.43429186771314376</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.43429186771314376</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>32778</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>32778</min_tcp_pkts><max_tcp_pkts>32778</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="176"><ip.session_id>89</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3026769161224365</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.07796287536621094</time_between_pkts_sum><time_between_pkts_avg>0.07796287536621094</time_between_pkts_avg><time_between_pkts_max>0.07796287536621094</time_between_pkts_max><time_between_pkts_min>0.07796287536621094</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4342771636778021</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4342771636778021</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="177"><ip.session_id>89</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.302683115005493</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.006198883056640625</time_between_pkts_sum><time_between_pkts_avg>0.006198883056640625</time_between_pkts_avg><time_between_pkts_max>0.006198883056640625</time_between_pkts_max><time_between_pkts_min>0.006198883056640625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4342759945923408</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4342759945923408</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1090</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1090</min_tcp_pkts><max_tcp_pkts>1090</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="178"><ip.session_id>90</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3029489517211914</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.2658367156982422</time_between_pkts_sum><time_between_pkts_avg>0.2658367156982422</time_between_pkts_avg><time_between_pkts_max>0.2658367156982422</time_between_pkts_max><time_between_pkts_min>0.2658367156982422</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4342258647342635</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4342258647342635</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="179"><ip.session_id>90</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.302954912185669</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4342247408790685</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4342247408790685</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>8333</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>8333</min_tcp_pkts><max_tcp_pkts>8333</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="180"><ip.session_id>91</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.302993059158325</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.03814697265625</time_between_pkts_sum><time_between_pkts_avg>0.03814697265625</time_between_pkts_avg><time_between_pkts_max>0.03814697265625</time_between_pkts_max><time_between_pkts_min>0.03814697265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.43421754834357595</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.43421754834357595</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="181"><ip.session_id>91</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.302999973297119</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.43421624472202547</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.43421624472202547</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1165</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1165</min_tcp_pkts><max_tcp_pkts>1165</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="182"><ip.session_id>92</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3030290603637695</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.029087066650390625</time_between_pkts_sum><time_between_pkts_avg>0.029087066650390625</time_between_pkts_avg><time_between_pkts_max>0.029087066650390625</time_between_pkts_max><time_between_pkts_min>0.029087066650390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4342107606067495</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4342107606067495</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="183"><ip.session_id>92</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.303035020828247</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.43420963682973746</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.43420963682973746</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>21571</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>21571</min_tcp_pkts><max_tcp_pkts>21571</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="184"><ip.session_id>93</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.30309796333313</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0629425048828125</time_between_pkts_sum><time_between_pkts_avg>0.0629425048828125</time_between_pkts_avg><time_between_pkts_max>0.0629425048828125</time_between_pkts_max><time_between_pkts_min>0.0629425048828125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.43419777009952387</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.43419777009952387</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="185"><ip.session_id>93</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3031060695648193</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.008106231689453125</time_between_pkts_sum><time_between_pkts_avg>0.008106231689453125</time_between_pkts_avg><time_between_pkts_max>0.008106231689453125</time_between_pkts_max><time_between_pkts_min>0.008106231689453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4341962418556579</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4341962418556579</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>6389</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>6389</min_tcp_pkts><max_tcp_pkts>6389</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="186"><ip.session_id>94</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.30309796333313</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.43419777009952387</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.43419777009952387</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="187"><ip.session_id>94</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3031139373779297</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.007867813110351562</time_between_pkts_sum><time_between_pkts_avg>0.007867813110351562</time_between_pkts_avg><time_between_pkts_max>0.007867813110351562</time_between_pkts_max><time_between_pkts_min>0.007867813110351562</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4341947585704289</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4341947585704289</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>60020</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>60020</min_tcp_pkts><max_tcp_pkts>60020</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="188"><ip.session_id>95</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.303118944168091</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.43419381466692325</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.43419381466692325</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="189"><ip.session_id>95</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.303126096725464</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.007152557373046875</time_between_pkts_sum><time_between_pkts_avg>0.007152557373046875</time_between_pkts_avg><time_between_pkts_max>0.007152557373046875</time_between_pkts_max><time_between_pkts_min>0.007152557373046875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.43419246624046287</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.43419246624046287</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>5002</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>5002</min_tcp_pkts><max_tcp_pkts>5002</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="190"><ip.session_id>96</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.303118944168091</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.43419381466692325</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.43419381466692325</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="191"><ip.session_id>96</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.303133010864258</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.43419116276951236</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.43419116276951236</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1110</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1110</min_tcp_pkts><max_tcp_pkts>1110</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="192"><ip.session_id>97</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.303118944168091</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.43419381466692325</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.43419381466692325</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="193"><ip.session_id>97</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3031370639801025</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0040531158447265625</time_between_pkts_sum><time_between_pkts_avg>0.0040531158447265625</time_between_pkts_avg><time_between_pkts_max>0.0040531158447265625</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4341903986694903</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4341903986694903</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>5087</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>5087</min_tcp_pkts><max_tcp_pkts>5087</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="194"><ip.session_id>98</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3031609058380127</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.02384185791015625</time_between_pkts_sum><time_between_pkts_avg>0.02384185791015625</time_between_pkts_avg><time_between_pkts_max>0.02384185791015625</time_between_pkts_max><time_between_pkts_min>0.02384185791015625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.43418590401791607</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.43418590401791607</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="195"><ip.session_id>98</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3031680583953857</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.007152557373046875</time_between_pkts_sum><time_between_pkts_avg>0.007152557373046875</time_between_pkts_avg><time_between_pkts_max>0.007152557373046875</time_between_pkts_max><time_between_pkts_min>0.007152557373046875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.43418455564058955</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.43418455564058955</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>9944</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>9944</min_tcp_pkts><max_tcp_pkts>9944</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="196"><ip.session_id>99</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3032100200653076</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.041961669921875</time_between_pkts_sum><time_between_pkts_avg>0.041961669921875</time_between_pkts_avg><time_between_pkts_max>0.041961669921875</time_between_pkts_max><time_between_pkts_min>0.041961669921875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.43417664532895917</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.43417664532895917</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="197"><ip.session_id>99</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.303215980529785</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.43417552172852686</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.43417552172852686</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1024</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1024</min_tcp_pkts><max_tcp_pkts>1024</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="198"><ip.session_id>100</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3032500743865967</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.03409385681152344</time_between_pkts_sum><time_between_pkts_avg>0.03409385681152344</time_between_pkts_avg><time_between_pkts_max>0.03409385681152344</time_between_pkts_max><time_between_pkts_min>0.03409385681152344</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4341690948458216</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4341690948458216</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="199"><ip.session_id>100</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3032569885253906</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4341677915151917</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4341677915151917</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>7000</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>7000</min_tcp_pkts><max_tcp_pkts>7000</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="200"><ip.session_id>101</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3032820224761963</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.025033950805664062</time_between_pkts_sum><time_between_pkts_avg>0.025033950805664062</time_between_pkts_avg><time_between_pkts_max>0.025033950805664062</time_between_pkts_max><time_between_pkts_min>0.025033950805664062</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.43416307262491766</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.43416307262491766</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="201"><ip.session_id>101</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3032889366149902</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.43416176933044354</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.43416176933044354</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>49159</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>49159</min_tcp_pkts><max_tcp_pkts>49159</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="202"><ip.session_id>102</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3033289909362793</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0400543212890625</time_between_pkts_sum><time_between_pkts_avg>0.0400543212890625</time_between_pkts_avg><time_between_pkts_max>0.0400543212890625</time_between_pkts_max><time_between_pkts_min>0.0400543212890625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.43415421936469023</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.43415421936469023</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="203"><ip.session_id>102</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3033370971679688</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.008106231689453125</time_between_pkts_sum><time_between_pkts_avg>0.008106231689453125</time_between_pkts_avg><time_between_pkts_max>0.008106231689453125</time_between_pkts_max><time_between_pkts_min>0.008106231689453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.434152691427379</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.434152691427379</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>10778</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>10778</min_tcp_pkts><max_tcp_pkts>10778</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="204"><ip.session_id>103</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3033289909362793</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.43415421936469023</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.43415421936469023</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="205"><ip.session_id>103</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.30334210395813</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4341517477067653</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4341517477067653</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1097</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1097</min_tcp_pkts><max_tcp_pkts>1097</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="206"><ip.session_id>104</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.303394079208374</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.051975250244140625</time_between_pkts_sum><time_between_pkts_avg>0.051975250244140625</time_between_pkts_avg><time_between_pkts_max>0.051975250244140625</time_between_pkts_max><time_between_pkts_min>0.051975250244140625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.43414195123036786</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.43414195123036786</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="207"><ip.session_id>104</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3034069538116455</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.012874603271484375</time_between_pkts_sum><time_between_pkts_avg>0.012874603271484375</time_between_pkts_avg><time_between_pkts_max>0.012874603271484375</time_between_pkts_max><time_between_pkts_min>0.012874603271484375</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4341395246485707</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4341395246485707</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1076</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1076</min_tcp_pkts><max_tcp_pkts>1076</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="208"><ip.session_id>105</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.303394079208374</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.43414195123036786</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.43414195123036786</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="209"><ip.session_id>105</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.303412914276123</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4341384012402582</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4341384012402582</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>56738</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>56738</min_tcp_pkts><max_tcp_pkts>56738</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="210"><ip.session_id>106</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3034169673919678</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0040531158447265625</time_between_pkts_sum><time_between_pkts_avg>0.0040531158447265625</time_between_pkts_avg><time_between_pkts_max>0.0040531158447265625</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4341376373259267</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4341376373259267</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="211"><ip.session_id>106</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.303421974182129</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4341366936707582</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4341366936707582</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>7921</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>7921</min_tcp_pkts><max_tcp_pkts>7921</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="212"><ip.session_id>107</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3034379482269287</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.015974044799804688</time_between_pkts_sum><time_between_pkts_avg>0.015974044799804688</time_between_pkts_avg><time_between_pkts_max>0.015974044799804688</time_between_pkts_max><time_between_pkts_min>0.015974044799804688</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.43413368298883415</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.43413368298883415</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="213"><ip.session_id>107</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.303446054458618</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.008106231689453125</time_between_pkts_sum><time_between_pkts_avg>0.008106231689453125</time_between_pkts_avg><time_between_pkts_max>0.008106231689453125</time_between_pkts_max><time_between_pkts_min>0.008106231689453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4341321551960683</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4341321551960683</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>24</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>24</min_tcp_pkts><max_tcp_pkts>24</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="214"><ip.session_id>108</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3035120964050293</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.06604194641113281</time_between_pkts_sum><time_between_pkts_avg>0.06604194641113281</time_between_pkts_avg><time_between_pkts_max>0.06604194641113281</time_between_pkts_max><time_between_pkts_min>0.06604194641113281</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4341197085791942</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4341197085791942</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="215"><ip.session_id>108</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.303518056869507</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.434118585273434</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.434118585273434</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1080</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1080</min_tcp_pkts><max_tcp_pkts>1080</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="216"><ip.session_id>109</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.303544044494629</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.025987625122070312</time_between_pkts_sum><time_between_pkts_avg>0.025987625122070312</time_between_pkts_avg><time_between_pkts_max>0.025987625122070312</time_between_pkts_max><time_between_pkts_min>0.025987625122070312</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.43411368772824505</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.43411368772824505</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="217"><ip.session_id>109</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3035500049591064</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4341125644536431</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4341125644536431</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>2809</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>2809</min_tcp_pkts><max_tcp_pkts>2809</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="218"><ip.session_id>110</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.303640127182007</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.09012222290039062</time_between_pkts_sum><time_between_pkts_avg>0.09012222290039062</time_between_pkts_avg><time_between_pkts_max>0.09012222290039062</time_between_pkts_max><time_between_pkts_min>0.09012222290039062</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.43409558125004466</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.43409558125004466</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="219"><ip.session_id>110</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3036460876464844</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4340944580691421</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4340944580691421</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>49175</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>49175</min_tcp_pkts><max_tcp_pkts>49175</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="220"><ip.session_id>111</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.303905963897705</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.2598762512207031</time_between_pkts_sum><time_between_pkts_avg>0.2598762512207031</time_between_pkts_avg><time_between_pkts_max>0.2598762512207031</time_between_pkts_max><time_between_pkts_min>0.2598762512207031</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.43404549303228446</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.43404549303228446</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="221"><ip.session_id>111</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3039119243621826</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4340443701105636</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4340443701105636</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>19780</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>19780</min_tcp_pkts><max_tcp_pkts>19780</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="222"><ip.session_id>112</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3040030002593994</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.09107589721679688</time_between_pkts_sum><time_between_pkts_avg>0.09107589721679688</time_between_pkts_avg><time_between_pkts_max>0.09107589721679688</time_between_pkts_max><time_between_pkts_min>0.09107589721679688</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.43402721258931243</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.43402721258931243</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="223"><ip.session_id>112</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.304008960723877</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4340260897621763</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4340260897621763</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1081</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1081</min_tcp_pkts><max_tcp_pkts>1081</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="224"><ip.session_id>113</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3040339946746826</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.025033950805664062</time_between_pkts_sum><time_between_pkts_avg>0.025033950805664062</time_between_pkts_avg><time_between_pkts_max>0.025033950805664062</time_between_pkts_max><time_between_pkts_min>0.025033950805664062</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.43402137395164375</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.43402137395164375</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="225"><ip.session_id>113</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3040459156036377</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.011920928955078125</time_between_pkts_sum><time_between_pkts_avg>0.011920928955078125</time_between_pkts_avg><time_between_pkts_max>0.011920928955078125</time_between_pkts_max><time_between_pkts_min>0.011920928955078125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.43401912836359846</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.43401912836359846</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>3301</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>3301</min_tcp_pkts><max_tcp_pkts>3301</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="226"><ip.session_id>114</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.304176092147827</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.13017654418945312</time_between_pkts_sum><time_between_pkts_avg>0.13017654418945312</time_between_pkts_avg><time_between_pkts_max>0.13017654418945312</time_between_pkts_max><time_between_pkts_min>0.13017654418945312</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4339946080543934</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4339946080543934</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="227"><ip.session_id>114</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.304183006286621</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4339933057711339</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4339933057711339</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>5730</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>5730</min_tcp_pkts><max_tcp_pkts>5730</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="228"><ip.session_id>115</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.304192066192627</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.009059906005859375</time_between_pkts_sum><time_between_pkts_avg>0.009059906005859375</time_between_pkts_avg><time_between_pkts_max>0.009059906005859375</time_between_pkts_max><time_between_pkts_min>0.009059906005859375</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.43399159934283077</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.43399159934283077</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="229"><ip.session_id>115</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.304197072982788</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4339906563224203</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4339906563224203</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>6788</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>6788</min_tcp_pkts><max_tcp_pkts>6788</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="230"><ip.session_id>116</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.304203987121582</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.43398935406287653</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.43398935406287653</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="231"><ip.session_id>116</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.304208993911743</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4339884110522235</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4339884110522235</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1083</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1083</min_tcp_pkts><max_tcp_pkts>1083</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="232"><ip.session_id>117</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3042519092559814</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.04291534423828125</time_between_pkts_sum><time_between_pkts_avg>0.04291534423828125</time_between_pkts_avg><time_between_pkts_max>0.04291534423828125</time_between_pkts_max><time_between_pkts_min>0.04291534423828125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4339803282718726</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4339803282718726</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="233"><ip.session_id>117</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.304258108139038</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.006198883056640625</time_between_pkts_sum><time_between_pkts_avg>0.006198883056640625</time_between_pkts_avg><time_between_pkts_max>0.006198883056640625</time_between_pkts_max><time_between_pkts_min>0.006198883056640625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.43397916078404025</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.43397916078404025</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>41511</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>41511</min_tcp_pkts><max_tcp_pkts>41511</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="234"><ip.session_id>118</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3042640686035156</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.43397803820550984</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.43397803820550984</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="235"><ip.session_id>118</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3042681217193604</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0040531158447265625</time_between_pkts_sum><time_between_pkts_avg>0.0040531158447265625</time_between_pkts_avg><time_between_pkts_max>0.0040531158447265625</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4339772748554264</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4339772748554264</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>7741</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>7741</min_tcp_pkts><max_tcp_pkts>7741</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="236"><ip.session_id>119</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3042969703674316</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.028848648071289062</time_between_pkts_sum><time_between_pkts_avg>0.028848648071289062</time_between_pkts_avg><time_between_pkts_max>0.028848648071289062</time_between_pkts_max><time_between_pkts_min>0.028848648071289062</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4339718416765288</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4339718416765288</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="237"><ip.session_id>119</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.304302930831909</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4339707191358628</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4339707191358628</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>3003</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>3003</min_tcp_pkts><max_tcp_pkts>3003</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="238"><ip.session_id>120</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3043570518493652</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.05412101745605469</time_between_pkts_sum><time_between_pkts_avg>0.05412101745605469</time_between_pkts_avg><time_between_pkts_max>0.05412101745605469</time_between_pkts_max><time_between_pkts_min>0.05412101745605469</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.43396052673236923</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.43396052673236923</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="239"><ip.session_id>120</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.304363965988159</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.43395922465363634</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.43395922465363634</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>52822</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>52822</min_tcp_pkts><max_tcp_pkts>52822</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="240"><ip.session_id>121</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.304460048675537</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.09608268737792969</time_between_pkts_sum><time_between_pkts_avg>0.09608268737792969</time_between_pkts_avg><time_between_pkts_max>0.09608268737792969</time_between_pkts_max><time_between_pkts_min>0.09608268737792969</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.43394113105789744</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.43394113105789744</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="241"><ip.session_id>121</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3044660091400146</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.43394000867610194</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.43394000867610194</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>30718</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>30718</min_tcp_pkts><max_tcp_pkts>30718</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="242"><ip.session_id>122</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3044910430908203</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.025033950805664062</time_between_pkts_sum><time_between_pkts_avg>0.025033950805664062</time_between_pkts_avg><time_between_pkts_max>0.025033950805664062</time_between_pkts_max><time_between_pkts_min>0.025033950805664062</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.43393529473596215</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.43393529473596215</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="243"><ip.session_id>122</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.304500102996826</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.009059906005859375</time_between_pkts_sum><time_between_pkts_avg>0.009059906005859375</time_between_pkts_avg><time_between_pkts_max>0.009059906005859375</time_between_pkts_max><time_between_pkts_min>0.009059906005859375</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.43393358876381755</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.43393358876381755</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1700</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1700</min_tcp_pkts><max_tcp_pkts>1700</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="244"><ip.session_id>123</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3044910430908203</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.43393529473596215</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.43393529473596215</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="245"><ip.session_id>123</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3045060634613037</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4339324664210377</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4339324664210377</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>787</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>787</min_tcp_pkts><max_tcp_pkts>787</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="246"><ip.session_id>124</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3045339584350586</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.027894973754882812</time_between_pkts_sum><time_between_pkts_avg>0.027894973754882812</time_between_pkts_avg><time_between_pkts_max>0.027894973754882812</time_between_pkts_max><time_between_pkts_min>0.027894973754882812</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4339272139339924</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4339272139339924</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="247"><ip.session_id>124</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.304539918899536</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4339260916241885</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4339260916241885</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1045</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1045</min_tcp_pkts><max_tcp_pkts>1045</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="248"><ip.session_id>125</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3045480251312256</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.008106231689453125</time_between_pkts_sum><time_between_pkts_avg>0.008106231689453125</time_between_pkts_avg><time_between_pkts_max>0.008106231689453125</time_between_pkts_max><time_between_pkts_min>0.008106231689453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.43392456529217177</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.43392456529217177</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="249"><ip.session_id>125</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3045530319213867</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.43392362256305506</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.43392362256305506</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1201</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1201</min_tcp_pkts><max_tcp_pkts>1201</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="250"><ip.session_id>126</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3047780990600586</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.225067138671875</time_between_pkts_sum><time_between_pkts_avg>0.225067138671875</time_between_pkts_avg><time_between_pkts_max>0.225067138671875</time_between_pkts_max><time_between_pkts_min>0.225067138671875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4338812488750318</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4338812488750318</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="251"><ip.session_id>126</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3047850131988525</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4338799472719939</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4338799472719939</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>12265</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>12265</min_tcp_pkts><max_tcp_pkts>12265</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="252"><ip.session_id>127</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.304810047149658</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.025033950805664062</time_between_pkts_sum><time_between_pkts_avg>0.025033950805664062</time_between_pkts_avg><time_between_pkts_max>0.025033950805664062</time_between_pkts_max><time_between_pkts_min>0.025033950805664062</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4338752346366646</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4338752346366646</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="253"><ip.session_id>127</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3048160076141357</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4338741125957229</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4338741125957229</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1088</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1088</min_tcp_pkts><max_tcp_pkts>1088</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="254"><ip.session_id>128</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.304827928543091</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.011920928955078125</time_between_pkts_sum><time_between_pkts_avg>0.011920928955078125</time_between_pkts_avg><time_between_pkts_max>0.011920928955078125</time_between_pkts_max><time_between_pkts_min>0.011920928955078125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4338718685312495</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4338718685312495</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="255"><ip.session_id>128</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.304832935333252</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.43387092603109284</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.43387092603109284</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>6667</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>6667</min_tcp_pkts><max_tcp_pkts>6667</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="256"><ip.session_id>129</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.304866075515747</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.03314018249511719</time_between_pkts_sum><time_between_pkts_avg>0.03314018249511719</time_between_pkts_avg><time_between_pkts_max>0.03314018249511719</time_between_pkts_max><time_between_pkts_min>0.03314018249511719</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.43386468768092545</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.43386468768092545</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="257"><ip.session_id>129</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3048760890960693</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.010013580322265625</time_between_pkts_sum><time_between_pkts_avg>0.010013580322265625</time_between_pkts_avg><time_between_pkts_max>0.010013580322265625</time_between_pkts_max><time_between_pkts_min>0.010013580322265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4338628027471021</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4338628027471021</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>10215</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>10215</min_tcp_pkts><max_tcp_pkts>10215</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="258"><ip.session_id>130</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.304882049560547</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.43386168077045933</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.43386168077045933</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="259"><ip.session_id>130</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.304887056350708</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4338607383145639</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4338607383145639</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>8087</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>8087</min_tcp_pkts><max_tcp_pkts>8087</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="260"><ip.session_id>131</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.304910898208618</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.02384185791015625</time_between_pkts_sum><time_between_pkts_avg>0.02384185791015625</time_between_pkts_avg><time_between_pkts_max>0.02384185791015625</time_between_pkts_max><time_between_pkts_min>0.02384185791015625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4338562504855186</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4338562504855186</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="261"><ip.session_id>131</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.304917097091675</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.006198883056640625</time_between_pkts_sum><time_between_pkts_avg>0.006198883056640625</time_between_pkts_avg><time_between_pkts_max>0.006198883056640625</time_between_pkts_max><time_between_pkts_min>0.006198883056640625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4338550836651746</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4338550836651746</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1192</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1192</min_tcp_pkts><max_tcp_pkts>1192</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="262"><ip.session_id>132</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3050761222839355</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.1590251922607422</time_between_pkts_sum><time_between_pkts_avg>0.1590251922607422</time_between_pkts_avg><time_between_pkts_max>0.1590251922607422</time_between_pkts_max><time_between_pkts_min>0.1590251922607422</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.43382515238115926</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.43382515238115926</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="263"><ip.session_id>132</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.305082082748413</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4338240305992368</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4338240305992368</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>2910</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>2910</min_tcp_pkts><max_tcp_pkts>2910</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="264"><ip.session_id>133</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3051140308380127</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.031948089599609375</time_between_pkts_sum><time_between_pkts_avg>0.031948089599609375</time_between_pkts_avg><time_between_pkts_max>0.031948089599609375</time_between_pkts_max><time_between_pkts_min>0.031948089599609375</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4338180179470145</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4338180179470145</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="265"><ip.session_id>133</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3051199913024902</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.43381689620198804</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.43381689620198804</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1098</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1098</min_tcp_pkts><max_tcp_pkts>1098</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="266"><ip.session_id>134</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3052330017089844</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.11301040649414062</time_between_pkts_sum><time_between_pkts_avg>0.11301040649414062</time_between_pkts_avg><time_between_pkts_max>0.11301040649414062</time_between_pkts_max><time_between_pkts_min>0.11301040649414062</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4337956290139218</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4337956290139218</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="267"><ip.session_id>134</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.305241107940674</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.008106231689453125</time_between_pkts_sum><time_between_pkts_avg>0.008106231689453125</time_between_pkts_avg><time_between_pkts_max>0.008106231689453125</time_between_pkts_max><time_between_pkts_min>0.008106231689453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.43379410359956816</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.43379410359956816</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1100</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1100</min_tcp_pkts><max_tcp_pkts>1100</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="268"><ip.session_id>135</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3052330017089844</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4337956290139218</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4337956290139218</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="269"><ip.session_id>135</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3052470684051514</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4337929819782112</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4337929819782112</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1141</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1141</min_tcp_pkts><max_tcp_pkts>1141</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="270"><ip.session_id>136</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.305264949798584</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.017881393432617188</time_between_pkts_sum><time_between_pkts_avg>0.017881393432617188</time_between_pkts_avg><time_between_pkts_max>0.017881393432617188</time_between_pkts_max><time_between_pkts_min>0.017881393432617188</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4337896171489408</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4337896171489408</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="271"><ip.session_id>136</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3052709102630615</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4337884955507841</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4337884955507841</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>5001</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>5001</min_tcp_pkts><max_tcp_pkts>5001</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="272"><ip.session_id>137</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3053500652313232</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.07915496826171875</time_between_pkts_sum><time_between_pkts_avg>0.07915496826171875</time_between_pkts_avg><time_between_pkts_max>0.07915496826171875</time_between_pkts_max><time_between_pkts_min>0.07915496826171875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4337736012771917</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4337736012771917</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="273"><ip.session_id>137</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.305356979370117</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4337723003199382</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4337723003199382</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>44501</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>44501</min_tcp_pkts><max_tcp_pkts>44501</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="274"><ip.session_id>138</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3053810596466064</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.024080276489257812</time_between_pkts_sum><time_between_pkts_avg>0.024080276489257812</time_between_pkts_avg><time_between_pkts_max>0.024080276489257812</time_between_pkts_max><time_between_pkts_min>0.024080276489257812</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.43376776946076356</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.43376776946076356</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="275"><ip.session_id>138</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.305388927459717</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.007867813110351562</time_between_pkts_sum><time_between_pkts_avg>0.007867813110351562</time_between_pkts_avg><time_between_pkts_max>0.007867813110351562</time_between_pkts_max><time_between_pkts_min>0.007867813110351562</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.43376628910154835</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.43376628910154835</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>2135</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>2135</min_tcp_pkts><max_tcp_pkts>2135</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="276"><ip.session_id>139</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.305393934249878</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.43376534706003594</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.43376534706003594</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="277"><ip.session_id>139</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.305398941040039</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4337644050226153</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4337644050226153</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1053</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1053</min_tcp_pkts><max_tcp_pkts>1053</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="278"><ip.session_id>140</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3054420948028564</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.04315376281738281</time_between_pkts_sum><time_between_pkts_avg>0.04315376281738281</time_between_pkts_avg><time_between_pkts_max>0.04315376281738281</time_between_pkts_max><time_between_pkts_min>0.04315376281738281</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4337562857268433</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4337562857268433</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="279"><ip.session_id>140</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.305448055267334</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4337551643010419</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4337551643010419</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1056</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1056</min_tcp_pkts><max_tcp_pkts>1056</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="280"><ip.session_id>141</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3054709434509277</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.02288818359375</time_between_pkts_sum><time_between_pkts_avg>0.02288818359375</time_between_pkts_avg><time_between_pkts_max>0.02288818359375</time_between_pkts_max><time_between_pkts_min>0.02288818359375</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4337508580798495</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4337508580798495</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="281"><ip.session_id>141</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.305479049682617</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.008106231689453125</time_between_pkts_sum><time_between_pkts_avg>0.008106231689453125</time_between_pkts_avg><time_between_pkts_max>0.008106231689453125</time_between_pkts_max><time_between_pkts_min>0.008106231689453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.43374933298034724</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.43374933298034724</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1075</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1075</min_tcp_pkts><max_tcp_pkts>1075</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="282"><ip.session_id>142</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3054850101470947</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4337482115904965</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4337482115904965</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="283"><ip.session_id>142</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.305490016937256</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4337472696275028</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4337472696275028</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>10621</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>10621</min_tcp_pkts><max_tcp_pkts>10621</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="284"><ip.session_id>143</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3056490421295166</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.1590251922607422</time_between_pkts_sum><time_between_pkts_avg>0.1590251922607422</time_between_pkts_avg><time_between_pkts_max>0.1590251922607422</time_between_pkts_max><time_between_pkts_min>0.1590251922607422</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4337173532171192</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4337173532171192</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="285"><ip.session_id>143</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3056559562683105</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4337160525972373</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4337160525972373</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>10626</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>10626</min_tcp_pkts><max_tcp_pkts>10626</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="286"><ip.session_id>144</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.305712938308716</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.05698204040527344</time_between_pkts_sum><time_between_pkts_avg>0.05698204040527344</time_between_pkts_avg><time_between_pkts_max>0.05698204040527344</time_between_pkts_max><time_between_pkts_min>0.05698204040527344</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4337053339924956</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4337053339924956</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="287"><ip.session_id>144</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3057210445404053</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.008106231689453125</time_between_pkts_sum><time_between_pkts_avg>0.008106231689453125</time_between_pkts_avg><time_between_pkts_max>0.008106231689453125</time_between_pkts_max><time_between_pkts_min>0.008106231689453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.43370380921310797</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.43370380921310797</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>17988</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>17988</min_tcp_pkts><max_tcp_pkts>17988</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="288"><ip.session_id>145</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.305712938308716</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4337053339924956</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4337053339924956</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="289"><ip.session_id>145</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.305727005004883</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4337026880586335</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4337026880586335</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>254</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>254</min_tcp_pkts><max_tcp_pkts>254</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="290"><ip.session_id>146</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.305732011795044</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4337017462933545</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4337017462933545</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="291"><ip.session_id>146</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3057360649108887</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0040531158447265625</time_between_pkts_sum><time_between_pkts_avg>0.0040531158447265625</time_between_pkts_avg><time_between_pkts_max>0.0040531158447265625</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4337009839149338</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4337009839149338</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>5357</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>5357</min_tcp_pkts><max_tcp_pkts>5357</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="292"><ip.session_id>147</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.30576491355896</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.028848648071289062</time_between_pkts_sum><time_between_pkts_avg>0.028848648071289062</time_between_pkts_avg><time_between_pkts_max>0.028848648071289062</time_between_pkts_max><time_between_pkts_min>0.028848648071289062</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4336955576518401</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4336955576518401</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="293"><ip.session_id>147</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3057730197906494</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.008106231689453125</time_between_pkts_sum><time_between_pkts_avg>0.008106231689453125</time_between_pkts_avg><time_between_pkts_max>0.008106231689453125</time_between_pkts_max><time_between_pkts_min>0.008106231689453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.433694032941193</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.433694032941193</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>5221</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>5221</min_tcp_pkts><max_tcp_pkts>5221</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="294"><ip.session_id>148</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3057780265808105</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.43369309121350197</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.43369309121350197</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="295"><ip.session_id>148</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3057830333709717</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.43369214948990065</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.43369214948990065</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1121</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1121</min_tcp_pkts><max_tcp_pkts>1121</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="296"><ip.session_id>149</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3058249950408936</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.041961669921875</time_between_pkts_sum><time_between_pkts_avg>0.041961669921875</time_between_pkts_avg><time_between_pkts_max>0.041961669921875</time_between_pkts_max><time_between_pkts_min>0.041961669921875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.43368425711000896</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.43368425711000896</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="297"><ip.session_id>149</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.305830955505371</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4336831360566192</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4336831360566192</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>4900</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>4900</min_tcp_pkts><max_tcp_pkts>4900</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="298"><ip.session_id>150</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3058600425720215</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.029087066650390625</time_between_pkts_sum><time_between_pkts_avg>0.029087066650390625</time_between_pkts_avg><time_between_pkts_max>0.029087066650390625</time_between_pkts_max><time_between_pkts_min>0.029087066650390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.43367766539922853</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.43367766539922853</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="299"><ip.session_id>150</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3058650493621826</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.43367672374261734</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.43367672374261734</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>11110</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>11110</min_tcp_pkts><max_tcp_pkts>11110</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="300"><ip.session_id>151</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.336168050765991</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>30.303001403808594</time_between_pkts_sum><time_between_pkts_avg>30.303001403808594</time_between_pkts_avg><time_between_pkts_max>30.303001403808594</time_between_pkts_max><time_between_pkts_min>30.303001403808594</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4280513979600553</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4280513979600553</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="301"><ip.session_id>151</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3361899852752686</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.02193450927734375</time_between_pkts_sum><time_between_pkts_avg>0.02193450927734375</time_between_pkts_avg><time_between_pkts_max>0.02193450927734375</time_between_pkts_max><time_between_pkts_min>0.02193450927734375</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4280473789815395</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4280473789815395</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1862</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1862</min_tcp_pkts><max_tcp_pkts>1862</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="302"><ip.session_id>152</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.336400032043457</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.21004676818847656</time_between_pkts_sum><time_between_pkts_avg>0.21004676818847656</time_between_pkts_avg><time_between_pkts_max>0.21004676818847656</time_between_pkts_max><time_between_pkts_min>0.21004676818847656</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.428008896715081</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.428008896715081</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="303"><ip.session_id>152</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3364078998565674</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.007867813110351562</time_between_pkts_sum><time_between_pkts_avg>0.007867813110351562</time_between_pkts_avg><time_between_pkts_max>0.007867813110351562</time_between_pkts_max><time_between_pkts_min>0.007867813110351562</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4280074554025392</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4280074554025392</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1580</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1580</min_tcp_pkts><max_tcp_pkts>1580</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="304"><ip.session_id>153</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3364129066467285</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42800653820870305</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42800653820870305</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="305"><ip.session_id>153</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3364179134368896</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4280056210187979</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4280056210187979</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>5911</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>5911</min_tcp_pkts><max_tcp_pkts>5911</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="306"><ip.session_id>154</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.336456060409546</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.03814697265625</time_between_pkts_sum><time_between_pkts_avg>0.03814697265625</time_between_pkts_avg><time_between_pkts_max>0.03814697265625</time_between_pkts_max><time_between_pkts_min>0.03814697265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42799863303430363</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42799863303430363</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="307"><ip.session_id>154</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3364620208740234</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4279975411823386</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4279975411823386</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>625</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>625</min_tcp_pkts><max_tcp_pkts>625</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="308"><ip.session_id>155</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.336513042449951</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.051021575927734375</time_between_pkts_sum><time_between_pkts_avg>0.051021575927734375</time_between_pkts_avg><time_between_pkts_max>0.051021575927734375</time_between_pkts_max><time_between_pkts_min>0.051021575927734375</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4279881951574513</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4279881951574513</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="309"><ip.session_id>155</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.336519956588745</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42798692867146426</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42798692867146426</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>2718</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>2718</min_tcp_pkts><max_tcp_pkts>2718</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="310"><ip.session_id>156</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3365280628204346</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.008106231689453125</time_between_pkts_sum><time_between_pkts_avg>0.008106231689453125</time_between_pkts_avg><time_between_pkts_max>0.008106231689453125</time_between_pkts_max><time_between_pkts_min>0.008106231689453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4279854438353696</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4279854438353696</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="311"><ip.session_id>156</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.336534023284912</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42798435205069646</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42798435205069646</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1199</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1199</min_tcp_pkts><max_tcp_pkts>1199</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="312"><ip.session_id>157</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.336632013320923</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.09799003601074219</time_between_pkts_sum><time_between_pkts_avg>0.09799003601074219</time_between_pkts_avg><time_between_pkts_max>0.09799003601074219</time_between_pkts_max><time_between_pkts_min>0.09799003601074219</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42796640390917035</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42796640390917035</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="313"><ip.session_id>157</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.336638927459717</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42796513755214743</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42796513755214743</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>500</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>500</min_tcp_pkts><max_tcp_pkts>500</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="314"><ip.session_id>158</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3366830348968506</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.04410743713378906</time_between_pkts_sum><time_between_pkts_avg>0.04410743713378906</time_between_pkts_avg><time_between_pkts_max>0.04410743713378906</time_between_pkts_max><time_between_pkts_min>0.04410743713378906</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42795705924408506</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42795705924408506</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="315"><ip.session_id>158</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3366940021514893</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.010967254638671875</time_between_pkts_sum><time_between_pkts_avg>0.010967254638671875</time_between_pkts_avg><time_between_pkts_max>0.010967254638671875</time_between_pkts_max><time_between_pkts_min>0.010967254638671875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4279550506310451</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4279550506310451</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>13783</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>13783</min_tcp_pkts><max_tcp_pkts>13783</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="316"><ip.session_id>159</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3366830348968506</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42795705924408506</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42795705924408506</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="317"><ip.session_id>159</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3367021083831787</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.008106231689453125</time_between_pkts_sum><time_between_pkts_avg>0.008106231689453125</time_between_pkts_avg><time_between_pkts_max>0.008106231689453125</time_between_pkts_max><time_between_pkts_min>0.008106231689453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42795356601613393</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42795356601613393</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1334</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1334</min_tcp_pkts><max_tcp_pkts>1334</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="318"><ip.session_id>160</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3366830348968506</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42795705924408506</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42795705924408506</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="319"><ip.session_id>160</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.33670711517334</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42795264905324637</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42795264905324637</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>8254</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>8254</min_tcp_pkts><max_tcp_pkts>8254</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="320"><ip.session_id>161</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3367130756378174</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42795155743588464</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42795155743588464</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="321"><ip.session_id>161</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.336719036102295</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42795046582409185</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42795046582409185</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>5961</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>5961</min_tcp_pkts><max_tcp_pkts>5961</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="322"><ip.session_id>162</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3367130756378174</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42795155743588464</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42795155743588464</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="323"><ip.session_id>162</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.336724042892456</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42794954887448955</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42794954887448955</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>10010</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>10010</min_tcp_pkts><max_tcp_pkts>10010</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="324"><ip.session_id>163</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.336754083633423</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.030040740966796875</time_between_pkts_sum><time_between_pkts_avg>0.030040740966796875</time_between_pkts_avg><time_between_pkts_max>0.030040740966796875</time_between_pkts_max><time_between_pkts_min>0.030040740966796875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42794404725939256</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42794404725939256</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="325"><ip.session_id>163</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.336761951446533</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42794260638357573</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42794260638357573</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>2119</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>2119</min_tcp_pkts><max_tcp_pkts>2119</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="326"><ip.session_id>164</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3367550373077393</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.00095367431640625</time_between_pkts_sum><time_between_pkts_avg>0.00095367431640625</time_between_pkts_avg><time_between_pkts_max>0.00095367431640625</time_between_pkts_max><time_between_pkts_min>0.00095367431640625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4279438726072616</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4279438726072616</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="327"><ip.session_id>164</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3367691040039062</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.007152557373046875</time_between_pkts_sum><time_between_pkts_avg>0.007152557373046875</time_between_pkts_avg><time_between_pkts_max>0.007152557373046875</time_between_pkts_max><time_between_pkts_min>0.007152557373046875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4279412965048892</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4279412965048892</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>9415</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>9415</min_tcp_pkts><max_tcp_pkts>9415</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="328"><ip.session_id>165</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3367950916290283</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.025987625122070312</time_between_pkts_sum><time_between_pkts_avg>0.025987625122070312</time_between_pkts_avg><time_between_pkts_max>0.025987625122070312</time_between_pkts_max><time_between_pkts_min>0.025987625122070312</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4279365373464899</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4279365373464899</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="329"><ip.session_id>165</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.336801052093506</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4279354458113217</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4279354458113217</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>12000</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>12000</min_tcp_pkts><max_tcp_pkts>12000</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="330"><ip.session_id>166</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3370039463043213</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.2028942108154297</time_between_pkts_sum><time_between_pkts_avg>0.2028942108154297</time_between_pkts_avg><time_between_pkts_max>0.2028942108154297</time_between_pkts_max><time_between_pkts_min>0.2028942108154297</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42789829327476087</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42789829327476087</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="331"><ip.session_id>166</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.337009906768799</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42789720193468156</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42789720193468156</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>33</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>33</min_tcp_pkts><max_tcp_pkts>33</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="332"><ip.session_id>167</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.337017059326172</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.007152557373046875</time_between_pkts_sum><time_between_pkts_avg>0.007152557373046875</time_between_pkts_avg><time_between_pkts_max>0.007152557373046875</time_between_pkts_max><time_between_pkts_min>0.007152557373046875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42789589233393455</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42789589233393455</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="333"><ip.session_id>167</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.337022066116333</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4278949756181813</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4278949756181813</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>616</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>616</min_tcp_pkts><max_tcp_pkts>616</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="334"><ip.session_id>168</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3370540142059326</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.031948089599609375</time_between_pkts_sum><time_between_pkts_avg>0.031948089599609375</time_between_pkts_avg><time_between_pkts_max>0.031948089599609375</time_between_pkts_max><time_between_pkts_min>0.031948089599609375</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4278891261911089</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4278891261911089</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="335"><ip.session_id>168</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3370609283447266</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4278878602913752</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4278878602913752</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>4899</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>4899</min_tcp_pkts><max_tcp_pkts>4899</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="336"><ip.session_id>169</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3370859622955322</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.025033950805664062</time_between_pkts_sum><time_between_pkts_avg>0.025033950805664062</time_between_pkts_avg><time_between_pkts_max>0.025033950805664062</time_between_pkts_max><time_between_pkts_min>0.025033950805664062</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42788327692396055</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42788327692396055</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="337"><ip.session_id>169</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3370931148529053</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.007152557373046875</time_between_pkts_sum><time_between_pkts_avg>0.007152557373046875</time_between_pkts_avg><time_between_pkts_max>0.007152557373046875</time_between_pkts_max><time_between_pkts_min>0.007152557373046875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4278819674084484</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4278819674084484</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>9003</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>9003</min_tcp_pkts><max_tcp_pkts>9003</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="338"><ip.session_id>170</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.337131977081299</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.03886222839355469</time_between_pkts_sum><time_between_pkts_avg>0.03886222839355469</time_between_pkts_avg><time_between_pkts_max>0.03886222839355469</time_between_pkts_max><time_between_pkts_min>0.03886222839355469</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4278748525142507</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4278748525142507</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="339"><ip.session_id>170</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3371400833129883</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.008106231689453125</time_between_pkts_sum><time_between_pkts_avg>0.008106231689453125</time_between_pkts_avg><time_between_pkts_max>0.008106231689453125</time_between_pkts_max><time_between_pkts_min>0.008106231689453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42787336845571555</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42787336845571555</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>8222</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>8222</min_tcp_pkts><max_tcp_pkts>8222</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="340"><ip.session_id>171</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.337131977081299</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4278748525142507</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4278748525142507</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="341"><ip.session_id>171</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.337146043777466</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42787227724277216</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42787227724277216</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>4848</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>4848</min_tcp_pkts><max_tcp_pkts>4848</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="342"><ip.session_id>172</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3374860286712646</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.3399848937988281</time_between_pkts_sum><time_between_pkts_avg>0.3399848937988281</time_between_pkts_avg><time_between_pkts_max>0.3399848937988281</time_between_pkts_max><time_between_pkts_min>0.3399848937988281</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42781004366834496</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42781004366834496</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="343"><ip.session_id>172</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3375179767608643</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.031948089599609375</time_between_pkts_sum><time_between_pkts_avg>0.031948089599609375</time_between_pkts_avg><time_between_pkts_max>0.031948089599609375</time_between_pkts_max><time_between_pkts_min>0.031948089599609375</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4278041965631066</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4278041965631066</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1062</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1062</min_tcp_pkts><max_tcp_pkts>1062</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="344"><ip.session_id>173</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3375439643859863</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.025987625122070312</time_between_pkts_sum><time_between_pkts_avg>0.025987625122070312</time_between_pkts_avg><time_between_pkts_max>0.025987625122070312</time_between_pkts_max><time_between_pkts_min>0.025987625122070312</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42779944045359364</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42779944045359364</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="345"><ip.session_id>173</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.337552070617676</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.008106231689453125</time_between_pkts_sum><time_between_pkts_avg>0.008106231689453125</time_between_pkts_avg><time_between_pkts_max>0.008106231689453125</time_between_pkts_max><time_between_pkts_min>0.008106231689453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.427797956918136</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.427797956918136</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>3871</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>3871</min_tcp_pkts><max_tcp_pkts>3871</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="346"><ip.session_id>174</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3375580310821533</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42779686608980494</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42779686608980494</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="347"><ip.session_id>174</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3375630378723145</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4277959497983059</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4277959497983059</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>722</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>722</min_tcp_pkts><max_tcp_pkts>722</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="348"><ip.session_id>175</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.337613105773926</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.050067901611328125</time_between_pkts_max><time_between_pkts_min>0.050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4277867870991957</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4277867870991957</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="349"><ip.session_id>175</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.337620973587036</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.007867813110351562</time_between_pkts_sum><time_between_pkts_avg>0.007867813110351562</time_between_pkts_avg><time_between_pkts_max>0.007867813110351562</time_between_pkts_max><time_between_pkts_min>0.007867813110351562</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4277853472821638</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4277853472821638</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>563</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>563</min_tcp_pkts><max_tcp_pkts>563</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="350"><ip.session_id>176</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.337613105773926</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4277867870991957</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4277867870991957</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="351"><ip.session_id>176</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3376269340515137</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4277842565181375</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4277842565181375</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>34573</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>34573</min_tcp_pkts><max_tcp_pkts>34573</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="352"><ip.session_id>177</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3376429080963135</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.015974044799804688</time_between_pkts_sum><time_between_pkts_avg>0.015974044799804688</time_between_pkts_avg><time_between_pkts_max>0.015974044799804688</time_between_pkts_max><time_between_pkts_min>0.015974044799804688</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42778133329797646</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42778133329797646</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="353"><ip.session_id>177</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3376519680023193</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.009059906005859375</time_between_pkts_sum><time_between_pkts_avg>0.009059906005859375</time_between_pkts_avg><time_between_pkts_max>0.009059906005859375</time_between_pkts_max><time_between_pkts_min>0.009059906005859375</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4277796753699684</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4277796753699684</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1216</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1216</min_tcp_pkts><max_tcp_pkts>1216</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="354"><ip.session_id>178</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3376429080963135</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42778133329797646</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42778133329797646</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="355"><ip.session_id>178</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3376591205596924</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.007152557373046875</time_between_pkts_sum><time_between_pkts_avg>0.007152557373046875</time_between_pkts_avg><time_between_pkts_max>0.007152557373046875</time_between_pkts_max><time_between_pkts_min>0.007152557373046875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4277783664885134</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4277783664885134</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>3517</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>3517</min_tcp_pkts><max_tcp_pkts>3517</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="356"><ip.session_id>179</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3376760482788086</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.016927719116210938</time_between_pkts_sum><time_between_pkts_avg>0.016927719116210938</time_between_pkts_avg><time_between_pkts_max>0.016927719116210938</time_between_pkts_max><time_between_pkts_min>0.016927719116210938</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4277752688343122</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4277752688343122</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="357"><ip.session_id>179</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.337683916091919</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.007867813110351562</time_between_pkts_sum><time_between_pkts_avg>0.007867813110351562</time_between_pkts_avg><time_between_pkts_max>0.007867813110351562</time_between_pkts_max><time_between_pkts_min>0.007867813110351562</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.427773829094814</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.427773829094814</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>4006</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>4006</min_tcp_pkts><max_tcp_pkts>4006</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="358"><ip.session_id>180</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3376760482788086</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4277752688343122</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4277752688343122</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="359"><ip.session_id>180</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3376920223236084</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.008106231689453125</time_between_pkts_sum><time_between_pkts_avg>0.008106231689453125</time_between_pkts_avg><time_between_pkts_max>0.008106231689453125</time_between_pkts_max><time_between_pkts_min>0.008106231689453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4277723457369823</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4277723457369823</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>5825</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>5825</min_tcp_pkts><max_tcp_pkts>5825</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="360"><ip.session_id>181</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3376970291137695</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42777142955051967</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42777142955051967</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="361"><ip.session_id>181</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3377010822296143</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0040531158447265625</time_between_pkts_sum><time_between_pkts_avg>0.0040531158447265625</time_between_pkts_avg><time_between_pkts_max>0.0040531158447265625</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4277706878786386</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4277706878786386</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1107</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1107</min_tcp_pkts><max_tcp_pkts>1107</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="362"><ip.session_id>182</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.33772611618042</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.025033950805664062</time_between_pkts_sum><time_between_pkts_avg>0.025033950805664062</time_between_pkts_avg><time_between_pkts_max>0.025033950805664062</time_between_pkts_max><time_between_pkts_min>0.025033950805664062</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4277661070210769</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4277661070210769</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="363"><ip.session_id>182</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3377320766448975</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4277650163551657</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4277650163551657</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>7019</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>7019</min_tcp_pkts><max_tcp_pkts>7019</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="364"><ip.session_id>183</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3377580642700195</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.025987625122070312</time_between_pkts_sum><time_between_pkts_avg>0.025987625122070312</time_between_pkts_avg><time_between_pkts_max>0.025987625122070312</time_between_pkts_max><time_between_pkts_min>0.025987625122070312</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4277602611167793</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4277602611167793</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="365"><ip.session_id>183</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3377630710601807</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42775934498208057</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42775934498208057</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>19283</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>19283</min_tcp_pkts><max_tcp_pkts>19283</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="366"><ip.session_id>184</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.337834119796753</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.07104873657226562</time_between_pkts_sum><time_between_pkts_avg>0.07104873657226562</time_between_pkts_avg><time_between_pkts_max>0.07104873657226562</time_between_pkts_max><time_between_pkts_min>0.07104873657226562</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4277463450173865</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4277463450173865</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="367"><ip.session_id>184</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3378400802612305</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4277452544522463</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4277452544522463</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>3551</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>3551</min_tcp_pkts><max_tcp_pkts>3551</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="368"><ip.session_id>185</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.337865114212036</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.025033950805664062</time_between_pkts_sum><time_between_pkts_avg>0.025033950805664062</time_between_pkts_avg><time_between_pkts_max>0.025033950805664062</time_between_pkts_max><time_between_pkts_min>0.025033950805664062</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42774067413938216</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42774067413938216</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="369"><ip.session_id>185</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.33787202835083</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42773940911787844</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42773940911787844</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>514</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>514</min_tcp_pkts><max_tcp_pkts>514</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="370"><ip.session_id>186</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.337877035140991</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.427738493072495</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.427738493072495</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="371"><ip.session_id>186</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3378820419311523</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42773757703103515</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42773757703103515</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>27356</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>27356</min_tcp_pkts><max_tcp_pkts>27356</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="372"><ip.session_id>187</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.337934970855713</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.052928924560546875</time_between_pkts_sum><time_between_pkts_avg>0.052928924560546875</time_between_pkts_avg><time_between_pkts_max>0.052928924560546875</time_between_pkts_max><time_between_pkts_min>0.052928924560546875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4277278934041471</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4277278934041471</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="373"><ip.session_id>187</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3379409313201904</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42772680293309173</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42772680293309173</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>63331</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>63331</min_tcp_pkts><max_tcp_pkts>63331</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="374"><ip.session_id>188</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3379640579223633</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.023126602172851562</time_between_pkts_sum><time_between_pkts_avg>0.023126602172851562</time_between_pkts_avg><time_between_pkts_max>0.023126602172851562</time_between_pkts_max><time_between_pkts_min>0.023126602172851562</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42772257195803604</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42772257195803604</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="375"><ip.session_id>188</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3379709720611572</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4277213070436025</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4277213070436025</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>17</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>17</min_tcp_pkts><max_tcp_pkts>17</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="376"><ip.session_id>189</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.338002920150757</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.031948089599609375</time_between_pkts_sum><time_between_pkts_avg>0.031948089599609375</time_between_pkts_avg><time_between_pkts_max>0.031948089599609375</time_between_pkts_max><time_between_pkts_min>0.031948089599609375</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4277154623637164</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4277154623637164</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="377"><ip.session_id>189</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3380110263824463</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.008106231689453125</time_between_pkts_sum><time_between_pkts_avg>0.008106231689453125</time_between_pkts_avg><time_between_pkts_max>0.008106231689453125</time_between_pkts_max><time_between_pkts_min>0.008106231689453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4277139794106439</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4277139794106439</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1037</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1037</min_tcp_pkts><max_tcp_pkts>1037</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="378"><ip.session_id>190</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3380179405212402</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42771271454703164</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42771271454703164</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="379"><ip.session_id>190</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3380250930786133</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.007152557373046875</time_between_pkts_sum><time_between_pkts_avg>0.007152557373046875</time_between_pkts_avg><time_between_pkts_max>0.007152557373046875</time_between_pkts_max><time_between_pkts_min>0.007152557373046875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4277114060753052</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4277114060753052</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>32779</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>32779</min_tcp_pkts><max_tcp_pkts>32779</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="380"><ip.session_id>191</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3380179405212402</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42771271454703164</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42771271454703164</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="381"><ip.session_id>191</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.338031053543091</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4277103156883154</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4277103156883154</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>2000</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>2000</min_tcp_pkts><max_tcp_pkts>2000</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="382"><ip.session_id>192</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.338059902191162</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.028848648071289062</time_between_pkts_sum><time_between_pkts_avg>0.028848648071289062</time_between_pkts_avg><time_between_pkts_max>0.028848648071289062</time_between_pkts_max><time_between_pkts_min>0.028848648071289062</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4277050382938559</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4277050382938559</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="383"><ip.session_id>192</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3380861282348633</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.026226043701171875</time_between_pkts_sum><time_between_pkts_avg>0.026226043701171875</time_between_pkts_avg><time_between_pkts_max>0.026226043701171875</time_between_pkts_max><time_between_pkts_min>0.026226043701171875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42770024077553953</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42770024077553953</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>7103</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>7103</min_tcp_pkts><max_tcp_pkts>7103</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="384"><ip.session_id>193</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.338092088699341</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42769915044547746</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42769915044547746</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="385"><ip.session_id>193</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.338097095489502</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42769823457252143</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42769823457252143</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>30000</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>30000</min_tcp_pkts><max_tcp_pkts>30000</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="386"><ip.session_id>194</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3381199836730957</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.02288818359375</time_between_pkts_sum><time_between_pkts_avg>0.02288818359375</time_between_pkts_avg><time_between_pkts_max>0.02288818359375</time_between_pkts_max><time_between_pkts_min>0.02288818359375</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42769404777467357</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42769404777467357</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="387"><ip.session_id>194</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3381259441375732</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4276929574761867</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4276929574761867</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>10024</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>10024</min_tcp_pkts><max_tcp_pkts>10024</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="388"><ip.session_id>195</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3381330966949463</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.007152557373046875</time_between_pkts_sum><time_between_pkts_avg>0.007152557373046875</time_between_pkts_avg><time_between_pkts_max>0.007152557373046875</time_between_pkts_max><time_between_pkts_min>0.007152557373046875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42769164912534013</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42769164912534013</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="389"><ip.session_id>195</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3381540775299072</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0209808349609375</time_between_pkts_sum><time_between_pkts_avg>0.0209808349609375</time_between_pkts_avg><time_between_pkts_max>0.0209808349609375</time_between_pkts_max><time_between_pkts_min>0.0209808349609375</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4276878113423682</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4276878113423682</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1666</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1666</min_tcp_pkts><max_tcp_pkts>1666</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="390"><ip.session_id>196</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3381640911102295</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.010013580322265625</time_between_pkts_sum><time_between_pkts_avg>0.010013580322265625</time_between_pkts_avg><time_between_pkts_max>0.010013580322265625</time_between_pkts_max><time_between_pkts_min>0.010013580322265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42768597969750294</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42768597969750294</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="391"><ip.session_id>196</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3381690979003906</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4276850638809535</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4276850638809535</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>2366</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>2366</min_tcp_pkts><max_tcp_pkts>2366</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="392"><ip.session_id>197</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3381850719451904</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.015974044799804688</time_between_pkts_sum><time_between_pkts_avg>0.015974044799804688</time_between_pkts_avg><time_between_pkts_max>0.015974044799804688</time_between_pkts_max><time_between_pkts_min>0.015974044799804688</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42768214201627625</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42768214201627625</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="393"><ip.session_id>197</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.338193893432617</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.008821487426757812</time_between_pkts_sum><time_between_pkts_avg>0.008821487426757812</time_between_pkts_avg><time_between_pkts_max>0.008821487426757812</time_between_pkts_max><time_between_pkts_min>0.008821487426757812</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4276805284663268</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4276805284663268</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>7007</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>7007</min_tcp_pkts><max_tcp_pkts>7007</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="394"><ip.session_id>198</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3381989002227783</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.427679612673123</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.427679612673123</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="395"><ip.session_id>198</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3382039070129395</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42767869688384114</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42767869688384114</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>4003</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>4003</min_tcp_pkts><max_tcp_pkts>4003</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="396"><ip.session_id>199</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3383281230926514</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.12421607971191406</time_between_pkts_sum><time_between_pkts_avg>0.12421607971191406</time_between_pkts_avg><time_between_pkts_max>0.12421607971191406</time_between_pkts_max><time_between_pkts_min>0.12421607971191406</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4276559778434385</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4276559778434385</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="397"><ip.session_id>199</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.338334083557129</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42765488773904214</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42765488773904214</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>3971</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>3971</min_tcp_pkts><max_tcp_pkts>3971</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="398"><ip.session_id>200</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.338346004486084</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.011920928955078125</time_between_pkts_sum><time_between_pkts_avg>0.011920928955078125</time_between_pkts_avg><time_between_pkts_max>0.011920928955078125</time_between_pkts_max><time_between_pkts_min>0.011920928955078125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42765270754692164</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42765270754692164</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="399"><ip.session_id>200</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3383519649505615</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42765161745919733</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42765161745919733</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>5822</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>5822</min_tcp_pkts><max_tcp_pkts>5822</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="400"><ip.session_id>201</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.339492082595825</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>1.1401176452636719</time_between_pkts_sum><time_between_pkts_avg>1.1401176452636719</time_between_pkts_avg><time_between_pkts_max>1.1401176452636719</time_between_pkts_max><time_between_pkts_min>1.1401176452636719</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4274432076258331</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4274432076258331</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="401"><ip.session_id>201</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3394980430603027</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4274421186058774</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4274421186058774</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>5432</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>5432</min_tcp_pkts><max_tcp_pkts>5432</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="402"><ip.session_id>202</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3395040035247803</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4274410295914708</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4274410295914708</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="403"><ip.session_id>202</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3395090103149414</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42744011482365757</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42744011482365757</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>20005</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>20005</min_tcp_pkts><max_tcp_pkts>20005</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="404"><ip.session_id>203</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.339534044265747</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.025033950805664062</time_between_pkts_sum><time_between_pkts_avg>0.025033950805664062</time_between_pkts_avg><time_between_pkts_max>0.025033950805664062</time_between_pkts_max><time_between_pkts_min>0.025033950805664062</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42743554104332165</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42743554104332165</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="405"><ip.session_id>203</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3395400047302246</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42743445206243064</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42743445206243064</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>13456</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>13456</min_tcp_pkts><max_tcp_pkts>13456</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="406"><ip.session_id>204</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.339571952819824</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.031948089599609375</time_between_pkts_sum><time_between_pkts_avg>0.031948089599609375</time_between_pkts_avg><time_between_pkts_max>0.031948089599609375</time_between_pkts_max><time_between_pkts_min>0.031948089599609375</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4274286152194321</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4274286152194321</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="407"><ip.session_id>204</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3395800590515137</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.008106231689453125</time_between_pkts_sum><time_between_pkts_avg>0.008106231689453125</time_between_pkts_avg><time_between_pkts_max>0.008106231689453125</time_between_pkts_max><time_between_pkts_min>0.008106231689453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4274271342547725</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4274271342547725</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1277</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1277</min_tcp_pkts><max_tcp_pkts>1277</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="408"><ip.session_id>205</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.339585065841675</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4274262195464332</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4274262195464332</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="409"><ip.session_id>205</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3395910263061523</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4274251306130385</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4274251306130385</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>12345</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>12345</min_tcp_pkts><max_tcp_pkts>12345</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="410"><ip.session_id>206</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3395941257476807</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0030994415283203125</time_between_pkts_sum><time_between_pkts_avg>0.0030994415283203125</time_between_pkts_avg><time_between_pkts_max>0.0030994415283203125</time_between_pkts_max><time_between_pkts_min>0.0030994415283203125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42742456436986603</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42742456436986603</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="411"><ip.session_id>206</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3395988941192627</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.00476837158203125</time_between_pkts_sum><time_between_pkts_avg>0.00476837158203125</time_between_pkts_avg><time_between_pkts_max>0.00476837158203125</time_between_pkts_max><time_between_pkts_min>0.00476837158203125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42742369322945334</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42742369322945334</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1839</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1839</min_tcp_pkts><max_tcp_pkts>1839</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="412"><ip.session_id>207</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3396708965301514</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.07200241088867188</time_between_pkts_sum><time_between_pkts_avg>0.07200241088867188</time_between_pkts_avg><time_between_pkts_max>0.07200241088867188</time_between_pkts_max><time_between_pkts_min>0.07200241088867188</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4274105394408461</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4274105394408461</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="413"><ip.session_id>207</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.339677095413208</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.006198883056640625</time_between_pkts_sum><time_between_pkts_avg>0.006198883056640625</time_between_pkts_avg><time_between_pkts_max>0.006198883056640625</time_between_pkts_max><time_between_pkts_min>0.006198883056640625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42740940703332014</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42740940703332014</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1027</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1027</min_tcp_pkts><max_tcp_pkts>1027</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="414"><ip.session_id>208</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.339729070663452</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.051975250244140625</time_between_pkts_sum><time_between_pkts_avg>0.051975250244140625</time_between_pkts_avg><time_between_pkts_max>0.051975250244140625</time_between_pkts_max><time_between_pkts_min>0.051975250244140625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42739991246783143</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42739991246783143</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="415"><ip.session_id>208</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.339740037918091</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.010967254638671875</time_between_pkts_sum><time_between_pkts_avg>0.010967254638671875</time_between_pkts_avg><time_between_pkts_max>0.010967254638671875</time_between_pkts_max><time_between_pkts_min>0.010967254638671875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42739790908130276</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42739790908130276</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>6792</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>6792</min_tcp_pkts><max_tcp_pkts>6792</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="416"><ip.session_id>209</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.339729070663452</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42739991246783143</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42739991246783143</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="417"><ip.session_id>209</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3397459983825684</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4273968202921536</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4273968202921536</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>45100</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>45100</min_tcp_pkts><max_tcp_pkts>45100</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="418"><ip.session_id>210</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.339729070663452</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42739991246783143</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42739991246783143</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="419"><ip.session_id>210</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.339750051498413</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0040531158447265625</time_between_pkts_sum><time_between_pkts_avg>0.0040531158447265625</time_between_pkts_avg><time_between_pkts_max>0.0040531158447265625</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42739607991870077</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42739607991870077</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>2099</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>2099</min_tcp_pkts><max_tcp_pkts>2099</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="420"><ip.session_id>211</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.339729070663452</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42739991246783143</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42739991246783143</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="421"><ip.session_id>211</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3397529125213623</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.00286102294921875</time_between_pkts_sum><time_between_pkts_avg>0.00286102294921875</time_between_pkts_avg><time_between_pkts_max>0.00286102294921875</time_between_pkts_max><time_between_pkts_min>0.00286102294921875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4273955573036902</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4273955573036902</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>48080</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>48080</min_tcp_pkts><max_tcp_pkts>48080</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="422"><ip.session_id>212</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3397560119628906</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0030994415283203125</time_between_pkts_sum><time_between_pkts_avg>0.0030994415283203125</time_between_pkts_avg><time_between_pkts_max>0.0030994415283203125</time_between_pkts_max><time_between_pkts_min>0.0030994415283203125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4273949911388711</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4273949911388711</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="423"><ip.session_id>212</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.339761972427368</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4273939023645887</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4273939023645887</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1070</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1070</min_tcp_pkts><max_tcp_pkts>1070</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="424"><ip.session_id>213</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3397560119628906</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4273949911388711</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4273949911388711</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="425"><ip.session_id>213</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3397679328918457</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42739281359585346</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42739281359585346</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>2399</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>2399</min_tcp_pkts><max_tcp_pkts>2399</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="426"><ip.session_id>214</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.339808940887451</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.04100799560546875</time_between_pkts_sum><time_between_pkts_avg>0.04100799560546875</time_between_pkts_avg><time_between_pkts_max>0.04100799560546875</time_between_pkts_max><time_between_pkts_min>0.04100799560546875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4273853230173214</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4273853230173214</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="427"><ip.session_id>214</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.33981990814209</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.010967254638671875</time_between_pkts_sum><time_between_pkts_avg>0.010967254638671875</time_between_pkts_avg><time_between_pkts_max>0.010967254638671875</time_between_pkts_max><time_between_pkts_min>0.010967254638671875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4273833197675627</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4273833197675627</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>14441</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>14441</min_tcp_pkts><max_tcp_pkts>14441</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="428"><ip.session_id>215</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.339808940887451</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4273853230173214</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4273853230173214</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="429"><ip.session_id>215</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.339824914932251</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4273824052467425</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4273824052467425</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>3737</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>3737</min_tcp_pkts><max_tcp_pkts>3737</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="430"><ip.session_id>216</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.339808940887451</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4273853230173214</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4273853230173214</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="431"><ip.session_id>216</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.339829921722412</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.427381490729836</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.427381490729836</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>2383</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>2383</min_tcp_pkts><max_tcp_pkts>2383</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="432"><ip.session_id>217</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.339832067489624</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0021457672119140625</time_between_pkts_sum><time_between_pkts_avg>0.0021457672119140625</time_between_pkts_avg><time_between_pkts_max>0.0021457672119140625</time_between_pkts_max><time_between_pkts_min>0.0021457672119140625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4273810987952171</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4273810987952171</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="433"><ip.session_id>217</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3398399353027344</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.007867813110351562</time_between_pkts_sum><time_between_pkts_avg>0.007867813110351562</time_between_pkts_avg><time_between_pkts_max>0.007867813110351562</time_between_pkts_max><time_between_pkts_min>0.007867813110351562</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4273796617077644</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4273796617077644</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>32771</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>32771</min_tcp_pkts><max_tcp_pkts>32771</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="434"><ip.session_id>218</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.339832067489624</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4273810987952171</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4273810987952171</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="435"><ip.session_id>218</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3398470878601074</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.007152557373046875</time_between_pkts_sum><time_between_pkts_avg>0.007152557373046875</time_between_pkts_avg><time_between_pkts_max>0.007152557373046875</time_between_pkts_max><time_between_pkts_min>0.007152557373046875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4273783552730122</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4273783552730122</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>4129</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>4129</min_tcp_pkts><max_tcp_pkts>4129</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="436"><ip.session_id>219</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3398489952087402</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0019073486328125</time_between_pkts_sum><time_between_pkts_avg>0.0019073486328125</time_between_pkts_avg><time_between_pkts_max>0.0019073486328125</time_between_pkts_max><time_between_pkts_min>0.0019073486328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42737800689176053</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42737800689176053</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="437"><ip.session_id>219</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3398540019989014</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42737709239367727</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42737709239367727</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1164</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1164</min_tcp_pkts><max_tcp_pkts>1164</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="438"><ip.session_id>220</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.339890956878662</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.03695487976074219</time_between_pkts_sum><time_between_pkts_avg>0.03695487976074219</time_between_pkts_avg><time_between_pkts_max>0.03695487976074219</time_between_pkts_max><time_between_pkts_min>0.03695487976074219</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4273703426479186</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4273703426479186</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="439"><ip.session_id>220</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.339898109436035</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.007152557373046875</time_between_pkts_sum><time_between_pkts_avg>0.007152557373046875</time_between_pkts_avg><time_between_pkts_max>0.007152557373046875</time_between_pkts_max><time_between_pkts_min>0.007152557373046875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4273690362701396</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4273690362701396</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>2920</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>2920</min_tcp_pkts><max_tcp_pkts>2920</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="440"><ip.session_id>221</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.339890956878662</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4273703426479186</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4273703426479186</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="441"><ip.session_id>221</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3399040699005127</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4273679476280913</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4273679476280913</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>7999</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>7999</min_tcp_pkts><max_tcp_pkts>7999</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="442"><ip.session_id>222</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3399250507354736</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0209808349609375</time_between_pkts_sum><time_between_pkts_avg>0.0209808349609375</time_between_pkts_avg><time_between_pkts_max>0.0209808349609375</time_between_pkts_max><time_between_pkts_min>0.0209808349609375</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42736411565220217</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42736411565220217</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="443"><ip.session_id>222</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3399319648742676</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4273628528570203</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4273628528570203</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>2800</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>2800</min_tcp_pkts><max_tcp_pkts>2800</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="444"><ip.session_id>223</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3399250507354736</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42736411565220217</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42736411565220217</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="445"><ip.session_id>223</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.339937925338745</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4273617642464739</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4273617642464739</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>9040</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>9040</min_tcp_pkts><max_tcp_pkts>9040</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="446"><ip.session_id>224</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.339961051940918</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.023126602172851562</time_between_pkts_sum><time_between_pkts_avg>0.023126602172851562</time_between_pkts_avg><time_between_pkts_max>0.023126602172851562</time_between_pkts_max><time_between_pkts_min>0.023126602172851562</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4273575404900582</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4273575404900582</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="447"><ip.session_id>224</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3399670124053955</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4273564519065757</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4273564519065757</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>49167</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>49167</min_tcp_pkts><max_tcp_pkts>49167</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="448"><ip.session_id>225</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3400230407714844</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.05602836608886719</time_between_pkts_sum><time_between_pkts_avg>0.05602836608886719</time_between_pkts_avg><time_between_pkts_max>0.05602836608886719</time_between_pkts_max><time_between_pkts_min>0.05602836608886719</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4273462194929111</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4273462194929111</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="449"><ip.session_id>225</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.340029001235962</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4273451309671024</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4273451309671024</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>9502</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>9502</min_tcp_pkts><max_tcp_pkts>9502</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="450"><ip.session_id>226</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.340070962905884</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.041961669921875</time_between_pkts_sum><time_between_pkts_avg>0.041961669921875</time_between_pkts_avg><time_between_pkts_max>0.041961669921875</time_between_pkts_max><time_between_pkts_min>0.041961669921875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42733746790234384</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42733746790234384</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="451"><ip.session_id>226</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.340078115463257</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.007152557373046875</time_between_pkts_sum><time_between_pkts_avg>0.007152557373046875</time_between_pkts_avg><time_between_pkts_max>0.007152557373046875</time_between_pkts_max><time_between_pkts_min>0.007152557373046875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4273361617255386</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4273361617255386</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>6002</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>6002</min_tcp_pkts><max_tcp_pkts>6002</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="452"><ip.session_id>227</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.370069980621338</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>29.991865158081055</time_between_pkts_sum><time_between_pkts_avg>29.991865158081055</time_between_pkts_avg><time_between_pkts_max>29.991865158081055</time_between_pkts_max><time_between_pkts_min>29.991865158081055</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42192846969769215</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42192846969769215</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="453"><ip.session_id>227</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.37007999420166</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.010013580322265625</time_between_pkts_sum><time_between_pkts_avg>0.010013580322265625</time_between_pkts_avg><time_between_pkts_max>0.010013580322265625</time_between_pkts_max><time_between_pkts_min>0.010013580322265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4219266870512701</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4219266870512701</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1051</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1051</min_tcp_pkts><max_tcp_pkts>1051</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="454"><ip.session_id>228</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.370382070541382</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.3020763397216797</time_between_pkts_sum><time_between_pkts_avg>0.3020763397216797</time_between_pkts_avg><time_between_pkts_max>0.3020763397216797</time_between_pkts_max><time_between_pkts_min>0.3020763397216797</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42187291763120943</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42187291763120943</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="455"><ip.session_id>228</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3703908920288086</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.008821487426757812</time_between_pkts_sum><time_between_pkts_avg>0.008821487426757812</time_between_pkts_avg><time_between_pkts_max>0.008821487426757812</time_between_pkts_max><time_between_pkts_min>0.008821487426757812</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42187134761731376</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42187134761731376</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1096</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1096</min_tcp_pkts><max_tcp_pkts>1096</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="456"><ip.session_id>229</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.370382070541382</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42187291763120943</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42187291763120943</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="457"><ip.session_id>229</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3703980445861816</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.007152557373046875</time_between_pkts_sum><time_between_pkts_avg>0.007152557373046875</time_between_pkts_avg><time_between_pkts_max>0.007152557373046875</time_between_pkts_max><time_between_pkts_min>0.007152557373046875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42187007464165266</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42187007464165266</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>9929</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>9929</min_tcp_pkts><max_tcp_pkts>9929</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="458"><ip.session_id>230</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3704020977020264</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0040531158447265625</time_between_pkts_sum><time_between_pkts_avg>0.0040531158447265625</time_between_pkts_avg><time_between_pkts_max>0.0040531158447265625</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4218693532921881</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4218693532921881</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="459"><ip.session_id>230</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.370408058166504</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42186829248863333</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42186829248863333</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>16012</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>16012</min_tcp_pkts><max_tcp_pkts>16012</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="460"><ip.session_id>231</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3704140186309814</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42186723169041335</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42186723169041335</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="461"><ip.session_id>231</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.370418071746826</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0040531158447265625</time_between_pkts_sum><time_between_pkts_avg>0.0040531158447265625</time_between_pkts_avg><time_between_pkts_max>0.0040531158447265625</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42186651035067096</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42186651035067096</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>10025</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>10025</min_tcp_pkts><max_tcp_pkts>10025</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="462"><ip.session_id>232</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.37048602104187</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.06794929504394531</time_between_pkts_sum><time_between_pkts_avg>0.06794929504394531</time_between_pkts_avg><time_between_pkts_max>0.06794929504394531</time_between_pkts_max><time_between_pkts_min>0.06794929504394531</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42185441766937</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42185441766937</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="463"><ip.session_id>232</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3704919815063477</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4218533569409259</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4218533569409259</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1812</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1812</min_tcp_pkts><max_tcp_pkts>1812</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="464"><ip.session_id>233</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.370561122894287</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.06914138793945312</time_between_pkts_sum><time_between_pkts_avg>0.06914138793945312</time_between_pkts_avg><time_between_pkts_max>0.06914138793945312</time_between_pkts_max><time_between_pkts_min>0.06914138793945312</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4218410528807926</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4218410528807926</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="465"><ip.session_id>233</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3705670833587646</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4218399922195573</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4218399922195573</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>3322</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>3322</min_tcp_pkts><max_tcp_pkts>3322</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="466"><ip.session_id>234</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.370734930038452</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.1678466796875</time_between_pkts_sum><time_between_pkts_avg>0.1678466796875</time_between_pkts_avg><time_between_pkts_max>0.1678466796875</time_between_pkts_max><time_between_pkts_min>0.1678466796875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42181012618892005</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42181012618892005</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="467"><ip.session_id>234</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.370742082595825</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.007152557373046875</time_between_pkts_sum><time_between_pkts_avg>0.007152557373046875</time_between_pkts_avg><time_between_pkts_max>0.007152557373046875</time_between_pkts_max><time_between_pkts_min>0.007152557373046875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42180885358269676</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42180885358269676</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1287</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1287</min_tcp_pkts><max_tcp_pkts>1287</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="468"><ip.session_id>235</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.37076997756958</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.027894973754882812</time_between_pkts_sum><time_between_pkts_avg>0.027894973754882812</time_between_pkts_avg><time_between_pkts_max>0.027894973754882812</time_between_pkts_max><time_between_pkts_min>0.027894973754882812</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42180389049179734</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42180389049179734</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="469"><ip.session_id>235</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.370779037475586</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.009059906005859375</time_between_pkts_sum><time_between_pkts_avg>0.009059906005859375</time_between_pkts_avg><time_between_pkts_max>0.009059906005859375</time_between_pkts_max><time_between_pkts_min>0.009059906005859375</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42180227857287095</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42180227857287095</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>6502</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>6502</min_tcp_pkts><max_tcp_pkts>6502</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="470"><ip.session_id>236</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3707869052886963</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.007867813110351562</time_between_pkts_sum><time_between_pkts_avg>0.007867813110351562</time_between_pkts_avg><time_between_pkts_max>0.007867813110351562</time_between_pkts_max><time_between_pkts_min>0.007867813110351562</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4218008787585351</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4218008787585351</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="471"><ip.session_id>236</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3707919120788574</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4217999879724315</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4217999879724315</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>8200</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>8200</min_tcp_pkts><max_tcp_pkts>8200</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="472"><ip.session_id>237</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.370819091796875</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.027179718017578125</time_between_pkts_sum><time_between_pkts_avg>0.027179718017578125</time_between_pkts_avg><time_between_pkts_max>0.027179718017578125</time_between_pkts_max><time_between_pkts_min>0.027179718017578125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4217951523420907</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4217951523420907</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="473"><ip.session_id>237</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.370826005935669</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42179392224329026</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42179392224329026</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>5922</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>5922</min_tcp_pkts><max_tcp_pkts>5922</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="474"><ip.session_id>238</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.37083101272583</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4217930314865689</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4217930314865689</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="475"><ip.session_id>238</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.370836019515991</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4217921407336097</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4217921407336097</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>10180</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>10180</min_tcp_pkts><max_tcp_pkts>10180</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="476"><ip.session_id>239</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.370858907699585</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.02288818359375</time_between_pkts_sum><time_between_pkts_avg>0.02288818359375</time_between_pkts_avg><time_between_pkts_max>0.02288818359375</time_between_pkts_max><time_between_pkts_min>0.02288818359375</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42178806876799246</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42178806876799246</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="477"><ip.session_id>239</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3708651065826416</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.006198883056640625</time_between_pkts_sum><time_between_pkts_avg>0.006198883056640625</time_between_pkts_avg><time_between_pkts_max>0.006198883056640625</time_between_pkts_max><time_between_pkts_min>0.006198883056640625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42178696595750115</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42178696595750115</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>52848</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>52848</min_tcp_pkts><max_tcp_pkts>52848</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="478"><ip.session_id>240</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3708889484405518</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.02384185791015625</time_between_pkts_sum><time_between_pkts_avg>0.02384185791015625</time_between_pkts_avg><time_between_pkts_max>0.02384185791015625</time_between_pkts_max><time_between_pkts_min>0.02384185791015625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42178272443243214</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42178272443243214</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="479"><ip.session_id>240</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3708949089050293</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4217816640644939</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4217816640644939</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>8100</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>8100</min_tcp_pkts><max_tcp_pkts>8100</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="480"><ip.session_id>241</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3709700107574463</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.07510185241699219</time_between_pkts_sum><time_between_pkts_avg>0.07510185241699219</time_between_pkts_avg><time_between_pkts_max>0.07510185241699219</time_between_pkts_max><time_between_pkts_min>0.07510185241699219</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4217683038852664</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4217683038852664</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="481"><ip.session_id>241</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.370975971221924</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4217672435898338</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4217672435898338</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>873</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>873</min_tcp_pkts><max_tcp_pkts>873</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="482"><ip.session_id>242</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.371098041534424</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.1220703125</time_between_pkts_sum><time_between_pkts_avg>0.1220703125</time_between_pkts_avg><time_between_pkts_max>0.1220703125</time_between_pkts_max><time_between_pkts_min>0.1220703125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4217455299118984</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4217455299118984</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="483"><ip.session_id>242</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3711071014404297</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.009059906005859375</time_between_pkts_sum><time_between_pkts_avg>0.009059906005859375</time_between_pkts_avg><time_between_pkts_max>0.009059906005859375</time_between_pkts_max><time_between_pkts_min>0.009059906005859375</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4217439184389889</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4217439184389889</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1244</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1244</min_tcp_pkts><max_tcp_pkts>1244</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="484"><ip.session_id>243</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.371098041534424</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4217455299118984</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4217455299118984</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="485"><ip.session_id>243</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3711130619049072</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4217428582661592</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4217428582661592</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>49161</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>49161</min_tcp_pkts><max_tcp_pkts>49161</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="486"><ip.session_id>244</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.371129035949707</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.015974044799804688</time_between_pkts_sum><time_between_pkts_avg>0.015974044799804688</time_between_pkts_avg><time_between_pkts_max>0.015974044799804688</time_between_pkts_max><time_between_pkts_min>0.015974044799804688</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.421740017029259</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.421740017029259</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="487"><ip.session_id>244</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.371134042739868</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42173912650020007</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42173912650020007</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1154</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1154</min_tcp_pkts><max_tcp_pkts>1154</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="488"><ip.session_id>245</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3711860179901123</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.051975250244140625</time_between_pkts_sum><time_between_pkts_avg>0.051975250244140625</time_between_pkts_avg><time_between_pkts_max>0.051975250244140625</time_between_pkts_max><time_between_pkts_min>0.051975250244140625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42172988218260066</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42172988218260066</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="489"><ip.session_id>245</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3711929321289062</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4217286524644704</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4217286524644704</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1043</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1043</min_tcp_pkts><max_tcp_pkts>1043</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="490"><ip.session_id>246</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3711979389190674</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4217277619834046</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4217277619834046</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="491"><ip.session_id>246</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.371201992034912</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0040531158447265625</time_between_pkts_sum><time_between_pkts_avg>0.0040531158447265625</time_between_pkts_avg><time_between_pkts_max>0.0040531158447265625</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4217270411205342</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4217270411205342</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1233</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1233</min_tcp_pkts><max_tcp_pkts>1233</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="492"><ip.session_id>247</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3712470531463623</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.04506111145019531</time_between_pkts_sum><time_between_pkts_avg>0.04506111145019531</time_between_pkts_avg><time_between_pkts_max>0.04506111145019531</time_between_pkts_max><time_between_pkts_min>0.04506111145019531</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4217190269875588</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4217190269875588</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="493"><ip.session_id>247</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3712549209594727</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.007867813110351562</time_between_pkts_sum><time_between_pkts_avg>0.007867813110351562</time_between_pkts_avg><time_between_pkts_max>0.007867813110351562</time_between_pkts_max><time_between_pkts_min>0.007867813110351562</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4217176277257333</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4217176277257333</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>50500</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>50500</min_tcp_pkts><max_tcp_pkts>50500</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="494"><ip.session_id>248</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3712470531463623</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4217190269875588</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4217190269875588</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="495"><ip.session_id>248</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3712620735168457</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.007152557373046875</time_between_pkts_sum><time_between_pkts_avg>0.007152557373046875</time_between_pkts_avg><time_between_pkts_max>0.007152557373046875</time_between_pkts_max><time_between_pkts_min>0.007152557373046875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4217163556775859</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4217163556775859</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>843</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>843</min_tcp_pkts><max_tcp_pkts>843</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="496"><ip.session_id>249</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3712880611419678</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.025987625122070312</time_between_pkts_sum><time_between_pkts_avg>0.025987625122070312</time_between_pkts_avg><time_between_pkts_max>0.025987625122070312</time_between_pkts_max><time_between_pkts_min>0.025987625122070312</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4217117339672426</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4217117339672426</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="497"><ip.session_id>249</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3712949752807617</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42171050435494634</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42171050435494634</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1533</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1533</min_tcp_pkts><max_tcp_pkts>1533</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="498"><ip.session_id>250</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.371299982070923</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42170961395051837</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42170961395051837</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="499"><ip.session_id>250</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3713040351867676</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0040531158447265625</time_between_pkts_sum><time_between_pkts_avg>0.0040531158447265625</time_between_pkts_avg><time_between_pkts_max>0.0040531158447265625</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42170889314968774</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42170889314968774</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>5566</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>5566</min_tcp_pkts><max_tcp_pkts>5566</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="500"><ip.session_id>251</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3713600635528564</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.05602836608886719</time_between_pkts_sum><time_between_pkts_avg>0.05602836608886719</time_between_pkts_avg><time_between_pkts_max>0.05602836608886719</time_between_pkts_max><time_between_pkts_min>0.05602836608886719</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42169892939065706</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42169892939065706</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="501"><ip.session_id>251</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.371366024017334</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4216978694440004</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4216978694440004</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>5004</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>5004</min_tcp_pkts><max_tcp_pkts>5004</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="502"><ip.session_id>252</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.371396064758301</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.030040740966796875</time_between_pkts_sum><time_between_pkts_avg>0.030040740966796875</time_between_pkts_avg><time_between_pkts_max>0.030040740966796875</time_between_pkts_max><time_between_pkts_min>0.030040740966796875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42169252739395213</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42169252739395213</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="503"><ip.session_id>252</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.371403932571411</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.007867813110351562</time_between_pkts_sum><time_between_pkts_avg>0.007867813110351562</time_between_pkts_avg><time_between_pkts_max>0.007867813110351562</time_between_pkts_max><time_between_pkts_min>0.007867813110351562</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42169112830797184</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42169112830797184</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>8007</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>8007</min_tcp_pkts><max_tcp_pkts>8007</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="504"><ip.session_id>253</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.371396064758301</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42169252739395213</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42169252739395213</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="505"><ip.session_id>253</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3714120388031006</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.008106231689453125</time_between_pkts_sum><time_between_pkts_avg>0.008106231689453125</time_between_pkts_avg><time_between_pkts_max>0.008106231689453125</time_between_pkts_max><time_between_pkts_min>0.008106231689453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42168968683515673</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42168968683515673</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>28201</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>28201</min_tcp_pkts><max_tcp_pkts>28201</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="506"><ip.session_id>254</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3714160919189453</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0040531158447265625</time_between_pkts_sum><time_between_pkts_avg>0.0040531158447265625</time_between_pkts_avg><time_between_pkts_max>0.0040531158447265625</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4216889661024447</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4216889661024447</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="507"><ip.session_id>254</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.371419906616211</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.003814697265625</time_between_pkts_sum><time_between_pkts_avg>0.003814697265625</time_between_pkts_avg><time_between_pkts_max>0.003814697265625</time_between_pkts_max><time_between_pkts_min>0.003814697265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42168828776802514</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42168828776802514</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>2967</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>2967</min_tcp_pkts><max_tcp_pkts>2967</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="508"><ip.session_id>255</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3714609146118164</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.04100799560546875</time_between_pkts_sum><time_between_pkts_avg>0.04100799560546875</time_between_pkts_avg><time_between_pkts_max>0.04100799560546875</time_between_pkts_max><time_between_pkts_min>0.04100799560546875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4216809958108416</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4216809958108416</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="509"><ip.session_id>255</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3714680671691895</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.007152557373046875</time_between_pkts_sum><time_between_pkts_avg>0.007152557373046875</time_between_pkts_avg><time_between_pkts_max>0.007152557373046875</time_between_pkts_max><time_between_pkts_min>0.007152557373046875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4216797239836737</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4216797239836737</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>9</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>9</min_tcp_pkts><max_tcp_pkts>9</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="510"><ip.session_id>256</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.371474027633667</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4216786641335609</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4216786641335609</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="511"><ip.session_id>256</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.371480941772461</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4216774347141045</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4216774347141045</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>44443</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>44443</min_tcp_pkts><max_tcp_pkts>44443</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="512"><ip.session_id>257</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3714890480041504</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.008106231689453125</time_between_pkts_sum><time_between_pkts_avg>0.008106231689453125</time_between_pkts_avg><time_between_pkts_max>0.008106231689453125</time_between_pkts_max><time_between_pkts_min>0.008106231689453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4216759933349057</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4216759933349057</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="513"><ip.session_id>257</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.371495008468628</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.421674933503546</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.421674933503546</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1074</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1074</min_tcp_pkts><max_tcp_pkts>1074</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="514"><ip.session_id>258</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3714890480041504</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4216759933349057</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4216759933349057</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="515"><ip.session_id>258</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3715031147003174</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.008106231689453125</time_between_pkts_sum><time_between_pkts_avg>0.008106231689453125</time_between_pkts_avg><time_between_pkts_max>0.008106231689453125</time_between_pkts_max><time_between_pkts_min>0.008106231689453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42167349214144645</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42167349214144645</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>106</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>106</min_tcp_pkts><max_tcp_pkts>106</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="516"><ip.session_id>259</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.371506929397583</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.003814697265625</time_between_pkts_sum><time_between_pkts_avg>0.003814697265625</time_between_pkts_avg><time_between_pkts_max>0.003814697265625</time_between_pkts_max><time_between_pkts_min>0.003814697265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4216728138568091</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4216728138568091</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="517"><ip.session_id>259</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3715131282806396</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.006198883056640625</time_between_pkts_sum><time_between_pkts_avg>0.006198883056640625</time_between_pkts_avg><time_between_pkts_max>0.006198883056640625</time_between_pkts_max><time_between_pkts_min>0.006198883056640625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4216717116489275</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4216717116489275</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1007</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1007</min_tcp_pkts><max_tcp_pkts>1007</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="518"><ip.session_id>260</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.371506929397583</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4216728138568091</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4216728138568091</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="519"><ip.session_id>260</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.371519088745117</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42167065183909075</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42167065183909075</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1443</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1443</min_tcp_pkts><max_tcp_pkts>1443</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="520"><ip.session_id>261</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.371544122695923</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.025033950805664062</time_between_pkts_sum><time_between_pkts_avg>0.025033950805664062</time_between_pkts_avg><time_between_pkts_max>0.025033950805664062</time_between_pkts_max><time_between_pkts_min>0.025033950805664062</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4216662006959501</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4216662006959501</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="521"><ip.session_id>261</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3715500831604004</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.421665140913815</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.421665140913815</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>8042</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>8042</min_tcp_pkts><max_tcp_pkts>8042</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="522"><ip.session_id>262</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.371584892272949</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.034809112548828125</time_between_pkts_sum><time_between_pkts_avg>0.034809112548828125</time_between_pkts_avg><time_between_pkts_max>0.034809112548828125</time_between_pkts_max><time_between_pkts_min>0.034809112548828125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4216589518925425</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4216589518925425</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="523"><ip.session_id>262</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3715929985046387</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.008106231689453125</time_between_pkts_sum><time_between_pkts_avg>0.008106231689453125</time_between_pkts_avg><time_between_pkts_max>0.008106231689453125</time_between_pkts_max><time_between_pkts_min>0.008106231689453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42165751063969675</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42165751063969675</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>5405</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>5405</min_tcp_pkts><max_tcp_pkts>5405</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="524"><ip.session_id>263</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.371584892272949</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4216589518925425</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4216589518925425</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="525"><ip.session_id>263</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.371612071990967</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.019073486328125</time_between_pkts_sum><time_between_pkts_avg>0.019073486328125</time_between_pkts_avg><time_between_pkts_max>0.019073486328125</time_between_pkts_max><time_between_pkts_min>0.019073486328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42165411949539483</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42165411949539483</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>8899</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>8899</min_tcp_pkts><max_tcp_pkts>8899</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="526"><ip.session_id>264</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.37162709236145</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.015020370483398438</time_between_pkts_sum><time_between_pkts_avg>0.015020370483398438</time_between_pkts_avg><time_between_pkts_max>0.015020370483398438</time_between_pkts_max><time_between_pkts_min>0.015020370483398438</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4216514490076478</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4216514490076478</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="527"><ip.session_id>264</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3716320991516113</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4216505588525824</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4216505588525824</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>3390</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>3390</min_tcp_pkts><max_tcp_pkts>3390</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="528"><ip.session_id>265</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3716630935668945</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.030994415283203125</time_between_pkts_sum><time_between_pkts_avg>0.030994415283203125</time_between_pkts_avg><time_between_pkts_max>0.030994415283203125</time_between_pkts_max><time_between_pkts_min>0.030994415283203125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42164504845249184</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42164504845249184</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="529"><ip.session_id>265</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.371674060821533</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.010967254638671875</time_between_pkts_sum><time_between_pkts_avg>0.010967254638671875</time_between_pkts_avg><time_between_pkts_max>0.010967254638671875</time_between_pkts_max><time_between_pkts_min>0.010967254638671875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4216430986531118</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4216430986531118</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>417</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>417</min_tcp_pkts><max_tcp_pkts>417</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="530"><ip.session_id>266</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3717169761657715</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.04291534423828125</time_between_pkts_sum><time_between_pkts_avg>0.04291534423828125</time_between_pkts_avg><time_between_pkts_max>0.04291534423828125</time_between_pkts_max><time_between_pkts_min>0.04291534423828125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4216354691767003</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4216354691767003</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="531"><ip.session_id>266</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.371725082397461</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.008106231689453125</time_between_pkts_sum><time_between_pkts_avg>0.008106231689453125</time_between_pkts_avg><time_between_pkts_max>0.008106231689453125</time_between_pkts_max><time_between_pkts_min>0.008106231689453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4216340280843802</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4216340280843802</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1105</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1105</min_tcp_pkts><max_tcp_pkts>1105</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="532"><ip.session_id>267</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3717870712280273</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.06198883056640625</time_between_pkts_sum><time_between_pkts_avg>0.06198883056640625</time_between_pkts_avg><time_between_pkts_max>0.06198883056640625</time_between_pkts_max><time_between_pkts_min>0.06198883056640625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4216230082923234</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4216230082923234</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="533"><ip.session_id>267</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.371798038482666</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.010967254638671875</time_between_pkts_sum><time_between_pkts_avg>0.010967254638671875</time_between_pkts_avg><time_between_pkts_max>0.010967254638671875</time_between_pkts_max><time_between_pkts_min>0.010967254638671875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4216210586967767</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4216210586967767</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1054</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1054</min_tcp_pkts><max_tcp_pkts>1054</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="534"><ip.session_id>268</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3717870712280273</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4216230082923234</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4216230082923234</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="535"><ip.session_id>268</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3718059062957764</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.007867813110351562</time_between_pkts_sum><time_between_pkts_avg>0.007867813110351562</time_between_pkts_avg><time_between_pkts_max>0.007867813110351562</time_between_pkts_max><time_between_pkts_min>0.007867813110351562</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4216196600849913</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4216196600849913</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1198</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1198</min_tcp_pkts><max_tcp_pkts>1198</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="536"><ip.session_id>269</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3717870712280273</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4216230082923234</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4216230082923234</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="537"><ip.session_id>269</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3718109130859375</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4216187700641409</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4216187700641409</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>7777</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>7777</min_tcp_pkts><max_tcp_pkts>7777</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="538"><ip.session_id>270</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.371814012527466</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0030994415283203125</time_between_pkts_sum><time_between_pkts_avg>0.0030994415283203125</time_between_pkts_avg><time_between_pkts_max>0.0030994415283203125</time_between_pkts_max><time_between_pkts_min>0.0030994415283203125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4216182191007356</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4216182191007356</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="539"><ip.session_id>270</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3718221187591553</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.008106231689453125</time_between_pkts_sum><time_between_pkts_avg>0.008106231689453125</time_between_pkts_avg><time_between_pkts_max>0.008106231689453125</time_between_pkts_max><time_between_pkts_min>0.008106231689453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4216167781263297</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4216167781263297</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1009</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1009</min_tcp_pkts><max_tcp_pkts>1009</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="540"><ip.session_id>271</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.371814012527466</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4216182191007356</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4216182191007356</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="541"><ip.session_id>271</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3718271255493164</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4216158881176466</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4216158881176466</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>911</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>911</min_tcp_pkts><max_tcp_pkts>911</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="542"><ip.session_id>272</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.371814012527466</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4216182191007356</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4216182191007356</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="543"><ip.session_id>272</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.371830940246582</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.003814697265625</time_between_pkts_sum><time_between_pkts_avg>0.003814697265625</time_between_pkts_avg><time_between_pkts_max>0.003814697265625</time_between_pkts_max><time_between_pkts_min>0.003814697265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4216152100183149</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4216152100183149</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>5051</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>5051</min_tcp_pkts><max_tcp_pkts>5051</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="544"><ip.session_id>273</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3718600273132324</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.029087066650390625</time_between_pkts_sum><time_between_pkts_avg>0.029087066650390625</time_between_pkts_avg><time_between_pkts_max>0.029087066650390625</time_between_pkts_max><time_between_pkts_min>0.029087066650390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4216100395826343</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4216100395826343</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="545"><ip.session_id>273</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3718678951263428</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42160864104395357</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42160864104395357</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>593</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>593</min_tcp_pkts><max_tcp_pkts>593</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="546"><ip.session_id>274</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.371860980987549</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.00095367431640625</time_between_pkts_sum><time_between_pkts_avg>0.00095367431640625</time_between_pkts_avg><time_between_pkts_max>0.00095367431640625</time_between_pkts_max><time_between_pkts_min>0.00095367431640625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42160987006230005</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42160987006230005</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="547"><ip.session_id>274</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3718740940093994</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.006198883056640625</time_between_pkts_sum><time_between_pkts_avg>0.006198883056640625</time_between_pkts_avg><time_between_pkts_max>0.006198883056640625</time_between_pkts_max><time_between_pkts_min>0.006198883056640625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4216075391715279</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4216075391715279</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1301</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1301</min_tcp_pkts><max_tcp_pkts>1301</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="548"><ip.session_id>275</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3719260692596436</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.051975250244140625</time_between_pkts_sum><time_between_pkts_avg>0.051975250244140625</time_between_pkts_avg><time_between_pkts_max>0.051975250244140625</time_between_pkts_max><time_between_pkts_min>0.051975250244140625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42159830062162645</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42159830062162645</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="549"><ip.session_id>275</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3719329833984375</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42159707167073024</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42159707167073024</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>705</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>705</min_tcp_pkts><max_tcp_pkts>705</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="550"><ip.session_id>276</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.371943950653076</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.010967254638671875</time_between_pkts_sum><time_between_pkts_avg>0.010967254638671875</time_between_pkts_avg><time_between_pkts_max>0.010967254638671875</time_between_pkts_max><time_between_pkts_min>0.010967254638671875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4215951223150388</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4215951223150388</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="551"><ip.session_id>276</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3719499111175537</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4215940628901586</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4215940628901586</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>125</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>125</min_tcp_pkts><max_tcp_pkts>125</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="552"><ip.session_id>277</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.373613119125366</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>1.6632080078125</time_between_pkts_sum><time_between_pkts_avg>1.6632080078125</time_between_pkts_avg><time_between_pkts_max>1.6632080078125</time_between_pkts_max><time_between_pkts_min>1.6632080078125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42129864885836243</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42129864885836243</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="553"><ip.session_id>277</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3736228942871094</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.009775161743164062</time_between_pkts_sum><time_between_pkts_avg>0.009775161743164062</time_between_pkts_avg><time_between_pkts_max>0.009775161743164062</time_between_pkts_max><time_between_pkts_min>0.009775161743164062</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4212969138471082</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4212969138471082</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>3878</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>3878</min_tcp_pkts><max_tcp_pkts>3878</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="554"><ip.session_id>278</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.373613119125366</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42129864885836243</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42129864885836243</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="555"><ip.session_id>278</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3736300468444824</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.007152557373046875</time_between_pkts_sum><time_between_pkts_avg>0.007152557373046875</time_between_pkts_avg><time_between_pkts_max>0.007152557373046875</time_between_pkts_max><time_between_pkts_min>0.007152557373046875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.421295644335732</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.421295644335732</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1131</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1131</min_tcp_pkts><max_tcp_pkts>1131</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="556"><ip.session_id>279</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3736629486083984</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.032901763916015625</time_between_pkts_sum><time_between_pkts_avg>0.032901763916015625</time_between_pkts_avg><time_between_pkts_max>0.032901763916015625</time_between_pkts_max><time_between_pkts_min>0.032901763916015625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4212898046819442</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4212898046819442</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="557"><ip.session_id>279</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.373668909072876</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42128874679096967</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42128874679096967</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>5718</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>5718</min_tcp_pkts><max_tcp_pkts>5718</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="558"><ip.session_id>280</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3736770153045654</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.008106231689453125</time_between_pkts_sum><time_between_pkts_avg>0.008106231689453125</time_between_pkts_avg><time_between_pkts_max>0.008106231689453125</time_between_pkts_max><time_between_pkts_min>0.008106231689453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4212873080677703</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4212873080677703</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="559"><ip.session_id>280</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3736820220947266</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4212864194495268</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4212864194495268</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>8194</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>8194</min_tcp_pkts><max_tcp_pkts>8194</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="560"><ip.session_id>281</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.373706102371216</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.024080276489257812</time_between_pkts_sum><time_between_pkts_avg>0.024080276489257812</time_between_pkts_avg><time_between_pkts_max>0.024080276489257812</time_between_pkts_max><time_between_pkts_min>0.024080276489257812</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4212821456712982</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4212821456712982</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="561"><ip.session_id>281</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3737130165100098</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4212809185628793</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4212809185628793</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>2008</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>2008</min_tcp_pkts><max_tcp_pkts>2008</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="562"><ip.session_id>282</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.373706102371216</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4212821456712982</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4212821456712982</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="563"><ip.session_id>282</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3737189769744873</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4212798607165317</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4212798607165317</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1187</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1187</min_tcp_pkts><max_tcp_pkts>1187</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="564"><ip.session_id>283</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3737409114837646</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.02193450927734375</time_between_pkts_sum><time_between_pkts_avg>0.02193450927734375</time_between_pkts_avg><time_between_pkts_max>0.02193450927734375</time_between_pkts_max><time_between_pkts_min>0.02193450927734375</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4212759678877193</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4212759678877193</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="565"><ip.session_id>283</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.373749017715454</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.008106231689453125</time_between_pkts_sum><time_between_pkts_avg>0.008106231689453125</time_between_pkts_avg><time_between_pkts_max>0.008106231689453125</time_between_pkts_max><time_between_pkts_min>0.008106231689453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42127452925179976</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42127452925179976</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>992</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>992</min_tcp_pkts><max_tcp_pkts>992</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="566"><ip.session_id>284</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3737409114837646</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4212759678877193</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4212759678877193</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="567"><ip.session_id>284</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3737540245056152</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4212736406874639</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4212736406874639</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>2601</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>2601</min_tcp_pkts><max_tcp_pkts>2601</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="568"><ip.session_id>285</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.37378191947937</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.027894973754882812</time_between_pkts_sum><time_between_pkts_avg>0.027894973754882812</time_between_pkts_avg><time_between_pkts_max>0.027894973754882812</time_between_pkts_max><time_between_pkts_min>0.027894973754882812</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4212686901833531</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4212686901833531</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="569"><ip.session_id>285</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3737881183624268</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.006198883056640625</time_between_pkts_sum><time_between_pkts_avg>0.006198883056640625</time_between_pkts_avg><time_between_pkts_max>0.006198883056640625</time_between_pkts_max><time_between_pkts_min>0.006198883056640625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.421267590087129</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.421267590087129</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>2191</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>2191</min_tcp_pkts><max_tcp_pkts>2191</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="570"><ip.session_id>286</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3738369941711426</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.04887580871582031</time_between_pkts_sum><time_between_pkts_avg>0.04887580871582031</time_between_pkts_avg><time_between_pkts_max>0.04887580871582031</time_between_pkts_max><time_between_pkts_min>0.04887580871582031</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4212589164527548</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4212589164527548</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="571"><ip.session_id>286</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3738439083099365</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4212576894796559</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4212576894796559</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>5298</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>5298</min_tcp_pkts><max_tcp_pkts>5298</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="572"><ip.session_id>287</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3738489151000977</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42125680098635643</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42125680098635643</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="573"><ip.session_id>287</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3738529682159424</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0040531158447265625</time_between_pkts_sum><time_between_pkts_avg>0.0040531158447265625</time_between_pkts_avg><time_between_pkts_max>0.0040531158447265625</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.421256081732621</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.421256081732621</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>3986</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>3986</min_tcp_pkts><max_tcp_pkts>3986</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="574"><ip.session_id>288</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3738839626312256</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.030994415283203125</time_between_pkts_sum><time_between_pkts_avg>0.030994415283203125</time_between_pkts_avg><time_between_pkts_max>0.030994415283203125</time_between_pkts_max><time_between_pkts_min>0.030994415283203125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4212505816382005</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4212505816382005</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="575"><ip.session_id>288</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3738911151885986</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.007152557373046875</time_between_pkts_sum><time_between_pkts_avg>0.007152557373046875</time_between_pkts_avg><time_between_pkts_max>0.007152557373046875</time_between_pkts_max><time_between_pkts_min>0.007152557373046875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.421249312406038</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.421249312406038</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>2500</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>2500</min_tcp_pkts><max_tcp_pkts>2500</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="576"><ip.session_id>289</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3738839626312256</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4212505816382005</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4212505816382005</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="577"><ip.session_id>289</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.373898983001709</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.007867813110351562</time_between_pkts_sum><time_between_pkts_avg>0.007867813110351562</time_between_pkts_avg><time_between_pkts_max>0.007867813110351562</time_between_pkts_max><time_between_pkts_min>0.007867813110351562</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4212479162594932</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4212479162594932</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>26214</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>26214</min_tcp_pkts><max_tcp_pkts>26214</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="578"><ip.session_id>290</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.373901128768921</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0021457672119140625</time_between_pkts_sum><time_between_pkts_avg>0.0021457672119140625</time_between_pkts_avg><time_between_pkts_max>0.0021457672119140625</time_between_pkts_max><time_between_pkts_min>0.0021457672119140625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42124753549385985</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42124753549385985</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="579"><ip.session_id>290</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.373908042907715</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4212463085870571</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4212463085870571</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>3703</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>3703</min_tcp_pkts><max_tcp_pkts>3703</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="580"><ip.session_id>291</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.373901128768921</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42124753549385985</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42124753549385985</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="581"><ip.session_id>291</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.373913049697876</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4212454201417648</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4212454201417648</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>5080</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>5080</min_tcp_pkts><max_tcp_pkts>5080</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="582"><ip.session_id>292</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.373932123184204</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.019073486328125</time_between_pkts_sum><time_between_pkts_avg>0.019073486328125</time_between_pkts_avg><time_between_pkts_max>0.019073486328125</time_between_pkts_max><time_between_pkts_min>0.019073486328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42124203562260215</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42124203562260215</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="583"><ip.session_id>292</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3739399909973145</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.007867813110351562</time_between_pkts_sum><time_between_pkts_avg>0.007867813110351562</time_between_pkts_avg><time_between_pkts_max>0.007867813110351562</time_between_pkts_max><time_between_pkts_min>0.007867813110351562</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4212406395242917</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4212406395242917</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>264</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>264</min_tcp_pkts><max_tcp_pkts>264</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="584"><ip.session_id>293</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.373932123184204</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42124203562260215</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42124203562260215</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="585"><ip.session_id>293</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3739469051361084</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4212394126576583</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4212394126576583</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1272</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1272</min_tcp_pkts><max_tcp_pkts>1272</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="586"><ip.session_id>294</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.373932123184204</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42124203562260215</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42124203562260215</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="587"><ip.session_id>294</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3739500045776367</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0030994415283203125</time_between_pkts_sum><time_between_pkts_avg>0.0030994415283203125</time_between_pkts_avg><time_between_pkts_max>0.0030994415283203125</time_between_pkts_max><time_between_pkts_min>0.0030994415283203125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42123886268528044</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42123886268528044</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>6101</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>6101</min_tcp_pkts><max_tcp_pkts>6101</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="588"><ip.session_id>295</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3739709854125977</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0209808349609375</time_between_pkts_sum><time_between_pkts_avg>0.0209808349609375</time_between_pkts_avg><time_between_pkts_max>0.0209808349609375</time_between_pkts_max><time_between_pkts_min>0.0209808349609375</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42123513983310096</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42123513983310096</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="589"><ip.session_id>295</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3739800453186035</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.009059906005859375</time_between_pkts_sum><time_between_pkts_avg>0.009059906005859375</time_between_pkts_avg><time_between_pkts_max>0.009059906005859375</time_between_pkts_max><time_between_pkts_min>0.009059906005859375</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4212335322581844</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4212335322581844</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>5061</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>5061</min_tcp_pkts><max_tcp_pkts>5061</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="590"><ip.session_id>296</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.373986005783081</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4212324746497993</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4212324746497993</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="591"><ip.session_id>296</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.373990058898926</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0040531158447265625</time_between_pkts_sum><time_between_pkts_avg>0.0040531158447265625</time_between_pkts_avg><time_between_pkts_max>0.0040531158447265625</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42123175547913094</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42123175547913094</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>4343</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>4343</min_tcp_pkts><max_tcp_pkts>4343</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="592"><ip.session_id>297</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.374006986618042</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.016927719116210938</time_between_pkts_sum><time_between_pkts_avg>0.016927719116210938</time_between_pkts_avg><time_between_pkts_max>0.016927719116210938</time_between_pkts_max><time_between_pkts_min>0.016927719116210938</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4212287519105316</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4212287519105316</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="593"><ip.session_id>297</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.374011993408203</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42122786353929487</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42122786353929487</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>7106</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>7106</min_tcp_pkts><max_tcp_pkts>7106</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="594"><ip.session_id>298</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.374037981033325</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.025987625122070312</time_between_pkts_sum><time_between_pkts_avg>0.025987625122070312</time_between_pkts_avg><time_between_pkts_max>0.025987625122070312</time_between_pkts_max><time_between_pkts_min>0.025987625122070312</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42122325252974235</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42122325252974235</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="595"><ip.session_id>298</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3740549087524414</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.016927719116210938</time_between_pkts_sum><time_between_pkts_avg>0.016927719116210938</time_between_pkts_avg><time_between_pkts_max>0.016927719116210938</time_between_pkts_max><time_between_pkts_min>0.016927719116210938</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4212202490824009</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4212202490824009</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>8300</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>8300</min_tcp_pkts><max_tcp_pkts>8300</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="596"><ip.session_id>299</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.374061107635498</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.006198883056640625</time_between_pkts_sum><time_between_pkts_avg>0.006198883056640625</time_between_pkts_avg><time_between_pkts_max>0.006198883056640625</time_between_pkts_max><time_between_pkts_min>0.006198883056640625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.421219149239159</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.421219149239159</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="597"><ip.session_id>299</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.374066114425659</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4212182609084258</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4212182609084258</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1186</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1186</min_tcp_pkts><max_tcp_pkts>1186</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="598"><ip.session_id>300</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.374089002609253</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.02288818359375</time_between_pkts_sum><time_between_pkts_avg>0.02288818359375</time_between_pkts_avg><time_between_pkts_max>0.02288818359375</time_between_pkts_max><time_between_pkts_min>0.02288818359375</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42121420001564625</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42121420001564625</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="599"><ip.session_id>300</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3740949630737305</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42121314250433534</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42121314250433534</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>515</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>515</min_tcp_pkts><max_tcp_pkts>515</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="600"><ip.session_id>301</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3742260932922363</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.13113021850585938</time_between_pkts_sum><time_between_pkts_avg>0.13113021850585938</time_between_pkts_avg><time_between_pkts_max>0.13113021850585938</time_between_pkts_max><time_between_pkts_min>0.13113021850585938</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42118987859885887</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42118987859885887</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="601"><ip.session_id>301</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.374232053756714</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4211888212096682</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4211888212096682</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1935</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1935</min_tcp_pkts><max_tcp_pkts>1935</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="602"><ip.session_id>302</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3742570877075195</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.025033950805664062</time_between_pkts_sum><time_between_pkts_avg>0.025033950805664062</time_between_pkts_avg><time_between_pkts_max>0.025033950805664062</time_between_pkts_max><time_between_pkts_min>0.025033950805664062</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4211843802330425</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4211843802330425</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="603"><ip.session_id>302</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.37426495552063</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.007867813110351562</time_between_pkts_sum><time_between_pkts_avg>0.007867813110351562</time_between_pkts_avg><time_between_pkts_max>0.007867813110351562</time_between_pkts_max><time_between_pkts_min>0.007867813110351562</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42118298451687314</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42118298451687314</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>5950</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>5950</min_tcp_pkts><max_tcp_pkts>5950</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="604"><ip.session_id>303</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.374274969100952</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.010013580322265625</time_between_pkts_sum><time_between_pkts_avg>0.010013580322265625</time_between_pkts_avg><time_between_pkts_max>0.010013580322265625</time_between_pkts_max><time_between_pkts_min>0.010013580322265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42118120816421784</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42118120816421784</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="605"><ip.session_id>303</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.3742809295654297</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.42118015081856064</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.42118015081856064</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>60443</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>60443</min_tcp_pkts><max_tcp_pkts>60443</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="606"><ip.session_id>304</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4040870666503906</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>29.806137084960938</time_between_pkts_sum><time_between_pkts_avg>29.806137084960938</time_between_pkts_avg><time_between_pkts_max>29.806137084960938</time_between_pkts_max><time_between_pkts_min>29.806137084960938</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.41595831277163264</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.41595831277163264</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="607"><ip.session_id>304</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4041121006011963</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.025033950805664062</time_between_pkts_sum><time_between_pkts_avg>0.025033950805664062</time_between_pkts_avg><time_between_pkts_max>0.025033950805664062</time_between_pkts_max><time_between_pkts_min>0.025033950805664062</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.41595398140957324</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.41595398140957324</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>3527</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>3527</min_tcp_pkts><max_tcp_pkts>3527</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="608"><ip.session_id>305</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4040870666503906</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.41595831277163264</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.41595831277163264</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="609"><ip.session_id>305</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.404123067855835</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.010967254638671875</time_between_pkts_sum><time_between_pkts_avg>0.010967254638671875</time_between_pkts_avg><time_between_pkts_max>0.010967254638671875</time_between_pkts_max><time_between_pkts_min>0.010967254638671875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4159520838888959</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4159520838888959</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1104</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1104</min_tcp_pkts><max_tcp_pkts>1104</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="610"><ip.session_id>306</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4040870666503906</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.41595831277163264</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.41595831277163264</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="611"><ip.session_id>306</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.404128074645996</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.41595121763521203</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.41595121763521203</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1556</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1556</min_tcp_pkts><max_tcp_pkts>1556</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="612"><ip.session_id>307</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.404129981994629</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0019073486328125</time_between_pkts_sum><time_between_pkts_avg>0.0019073486328125</time_between_pkts_avg><time_between_pkts_max>0.0019073486328125</time_between_pkts_max><time_between_pkts_min>0.0019073486328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.41595088763475774</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.41595088763475774</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="613"><ip.session_id>307</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4041340351104736</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0040531158447265625</time_between_pkts_sum><time_between_pkts_avg>0.0040531158447265625</time_between_pkts_avg><time_between_pkts_max>0.0040531158447265625</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4159501863855309</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4159501863855309</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>666</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>666</min_tcp_pkts><max_tcp_pkts>666</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="614"><ip.session_id>308</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4041929244995117</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.05888938903808594</time_between_pkts_sum><time_between_pkts_avg>0.05888938903808594</time_between_pkts_avg><time_between_pkts_max>0.05888938903808594</time_between_pkts_max><time_between_pkts_min>0.05888938903808594</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.415939997913509</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.415939997913509</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="615"><ip.session_id>308</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4041991233825684</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.006198883056640625</time_between_pkts_sum><time_between_pkts_avg>0.006198883056640625</time_between_pkts_avg><time_between_pkts_max>0.006198883056640625</time_between_pkts_max><time_between_pkts_min>0.006198883056640625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.41593892547180455</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.41593892547180455</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>7496</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>7496</min_tcp_pkts><max_tcp_pkts>7496</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="616"><ip.session_id>309</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.40434193611145</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.14281272888183594</time_between_pkts_sum><time_between_pkts_avg>0.14281272888183594</time_between_pkts_avg><time_between_pkts_max>0.14281272888183594</time_between_pkts_max><time_between_pkts_min>0.14281272888183594</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4159142195961125</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4159142195961125</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="617"><ip.session_id>309</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4043478965759277</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.41591318852987824</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.41591318852987824</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1248</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1248</min_tcp_pkts><max_tcp_pkts>1248</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="618"><ip.session_id>310</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.404352903366089</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.41591232243819204</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.41591232243819204</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="619"><ip.session_id>310</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.40435791015625</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.41591145635011295</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.41591145635011295</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>2021</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>2021</min_tcp_pkts><max_tcp_pkts>2021</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="620"><ip.session_id>311</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.404397964477539</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0400543212890625</time_between_pkts_sum><time_between_pkts_avg>0.0400543212890625</time_between_pkts_avg><time_between_pkts_max>0.0400543212890625</time_between_pkts_max><time_between_pkts_min>0.0400543212890625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4159045277753318</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4159045277753318</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="621"><ip.session_id>311</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4044039249420166</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4159034967571497</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4159034967571497</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>3800</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>3800</min_tcp_pkts><max_tcp_pkts>3800</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="622"><ip.session_id>312</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4044089317321777</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.41590263070582706</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.41590263070582706</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="623"><ip.session_id>312</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.404413938522339</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4159017646581112</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4159017646581112</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>427</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>427</min_tcp_pkts><max_tcp_pkts>427</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="624"><ip.session_id>313</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4044370651245117</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.023126602172851562</time_between_pkts_sum><time_between_pkts_avg>0.023126602172851562</time_between_pkts_avg><time_between_pkts_max>0.023126602172851562</time_between_pkts_max><time_between_pkts_min>0.023126602172851562</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4158977643892775</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4158977643892775</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="625"><ip.session_id>313</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4044480323791504</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.010967254638671875</time_between_pkts_sum><time_between_pkts_avg>0.010967254638671875</time_between_pkts_avg><time_between_pkts_max>0.010967254638671875</time_between_pkts_max><time_between_pkts_min>0.010967254638671875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.41589586738147183</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.41589586738147183</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>19</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>19</min_tcp_pkts><max_tcp_pkts>19</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="626"><ip.session_id>314</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4044649600982666</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.016927719116210938</time_between_pkts_sum><time_between_pkts_avg>0.016927719116210938</time_between_pkts_avg><time_between_pkts_max>0.016927719116210938</time_between_pkts_max><time_between_pkts_min>0.016927719116210938</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.41589293942513167</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.41589293942513167</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="627"><ip.session_id>314</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4044740200042725</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.009059906005859375</time_between_pkts_sum><time_between_pkts_avg>0.009059906005859375</time_between_pkts_avg><time_between_pkts_max>0.009059906005859375</time_between_pkts_max><time_between_pkts_min>0.009059906005859375</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4158913723668443</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4158913723668443</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1218</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1218</min_tcp_pkts><max_tcp_pkts>1218</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="628"><ip.session_id>315</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4044649600982666</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.41589293942513167</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.41589293942513167</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="629"><ip.session_id>315</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.404482126235962</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.008106231689453125</time_between_pkts_sum><time_between_pkts_avg>0.008106231689453125</time_between_pkts_avg><time_between_pkts_max>0.008106231689453125</time_between_pkts_max><time_between_pkts_min>0.008106231689453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.41588997027207086</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.41588997027207086</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>990</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>990</min_tcp_pkts><max_tcp_pkts>990</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="630"><ip.session_id>316</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4044859409332275</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.003814697265625</time_between_pkts_sum><time_between_pkts_avg>0.003814697265625</time_between_pkts_avg><time_between_pkts_max>0.003814697265625</time_between_pkts_max><time_between_pkts_min>0.003814697265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.41588931046603694</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.41588931046603694</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="631"><ip.session_id>316</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4044899940490723</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0040531158447265625</time_between_pkts_sum><time_between_pkts_avg>0.0040531158447265625</time_between_pkts_avg><time_between_pkts_max>0.0040531158447265625</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.41588860942441974</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.41588860942441974</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1130</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1130</min_tcp_pkts><max_tcp_pkts>1130</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="632"><ip.session_id>317</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.40449595451355</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4158875784851585</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4158875784851585</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="633"><ip.session_id>317</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4045000076293945</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0040531158447265625</time_between_pkts_sum><time_between_pkts_avg>0.0040531158447265625</time_between_pkts_avg><time_between_pkts_max>0.0040531158447265625</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4158868774493803</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4158868774493803</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1271</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1271</min_tcp_pkts><max_tcp_pkts>1271</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="634"><ip.session_id>318</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.404585123062134</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.08511543273925781</time_between_pkts_sum><time_between_pkts_avg>0.08511543273925781</time_between_pkts_avg><time_between_pkts_max>0.08511543273925781</time_between_pkts_max><time_between_pkts_min>0.08511543273925781</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.41587215624396107</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.41587215624396107</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="635"><ip.session_id>318</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.404590129852295</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.41587129032315634</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.41587129032315634</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>2005</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>2005</min_tcp_pkts><max_tcp_pkts>2005</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="636"><ip.session_id>319</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4046759605407715</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0858306884765625</time_between_pkts_sum><time_between_pkts_avg>0.0858306884765625</time_between_pkts_avg><time_between_pkts_max>0.0858306884765625</time_between_pkts_max><time_between_pkts_min>0.0858306884765625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.41585644652725545</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.41585644652725545</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="637"><ip.session_id>319</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.404681921005249</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.41585541574744395</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.41585541574744395</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>631</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>631</min_tcp_pkts><max_tcp_pkts>631</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="638"><ip.session_id>320</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4047610759735107</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.07915496826171875</time_between_pkts_sum><time_between_pkts_avg>0.07915496826171875</time_between_pkts_avg><time_between_pkts_max>0.07915496826171875</time_between_pkts_max><time_between_pkts_min>0.07915496826171875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4158417274760544</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4158417274760544</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="639"><ip.session_id>320</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4047670364379883</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4158406967692095</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4158406967692095</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1688</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1688</min_tcp_pkts><max_tcp_pkts>1688</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="640"><ip.session_id>321</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4048380851745605</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.07104873657226562</time_between_pkts_sum><time_between_pkts_avg>0.07104873657226562</time_between_pkts_avg><time_between_pkts_max>0.07104873657226562</time_between_pkts_max><time_between_pkts_min>0.07104873657226562</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.41582841113704866</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.41582841113704866</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="641"><ip.session_id>321</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.404844045639038</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4158273804962144</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4158273804962144</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>6699</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>6699</min_tcp_pkts><max_tcp_pkts>6699</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="642"><ip.session_id>322</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.404953956604004</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.10991096496582031</time_between_pkts_sum><time_between_pkts_avg>0.10991096496582031</time_between_pkts_avg><time_between_pkts_max>0.10991096496582031</time_between_pkts_max><time_between_pkts_min>0.10991096496582031</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4158083763948993</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4158083763948993</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="643"><ip.session_id>322</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4049599170684814</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.41580734585337575</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.41580734585337575</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>3918</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>3918</min_tcp_pkts><max_tcp_pkts>3918</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="644"><ip.session_id>323</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4052720069885254</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.3120899200439453</time_between_pkts_sum><time_between_pkts_avg>0.3120899200439453</time_between_pkts_avg><time_between_pkts_max>0.3120899200439453</time_between_pkts_max><time_between_pkts_min>0.3120899200439453</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.41575339383425114</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.41575339383425114</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="645"><ip.session_id>323</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4052789211273193</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4157521987226806</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4157521987226806</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>6</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>6</min_tcp_pkts><max_tcp_pkts>6</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="646"><ip.session_id>324</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4056179523468018</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.3390312194824219</time_between_pkts_sum><time_between_pkts_avg>0.3390312194824219</time_between_pkts_avg><time_between_pkts_max>0.3390312194824219</time_between_pkts_max><time_between_pkts_min>0.3390312194824219</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4156936054723276</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4156936054723276</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="647"><ip.session_id>324</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.405626058578491</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.008106231689453125</time_between_pkts_sum><time_between_pkts_avg>0.008106231689453125</time_between_pkts_avg><time_between_pkts_max>0.008106231689453125</time_between_pkts_max><time_between_pkts_min>0.008106231689453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4156922047106981</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4156922047106981</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>2126</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>2126</min_tcp_pkts><max_tcp_pkts>2126</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="648"><ip.session_id>325</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.405630111694336</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0040531158447265625</time_between_pkts_sum><time_between_pkts_avg>0.0040531158447265625</time_between_pkts_avg><time_between_pkts_max>0.0040531158447265625</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.41569150433342344</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.41569150433342344</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="649"><ip.session_id>325</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.405635118484497</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4156906391647543</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4156906391647543</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>30951</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>30951</min_tcp_pkts><max_tcp_pkts>30951</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="650"><ip.session_id>326</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.405827045440674</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.1919269561767578</time_between_pkts_sum><time_between_pkts_avg>0.1919269561767578</time_between_pkts_avg><time_between_pkts_max>0.1919269561767578</time_between_pkts_max><time_between_pkts_min>0.1919269561767578</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.41565747708053996</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.41565747708053996</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="651"><ip.session_id>326</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4058339595794678</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.41565628252034353</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.41565628252034353</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1066</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1066</min_tcp_pkts><max_tcp_pkts>1066</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="652"><ip.session_id>327</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4058899879455566</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.05602836608886719</time_between_pkts_sum><time_between_pkts_avg>0.05602836608886719</time_between_pkts_avg><time_between_pkts_max>0.05602836608886719</time_between_pkts_max><time_between_pkts_min>0.05602836608886719</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.41564660271682763</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.41564660271682763</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="653"><ip.session_id>327</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.405895948410034</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4156455729770285</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4156455729770285</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>3369</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>3369</min_tcp_pkts><max_tcp_pkts>3369</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="654"><ip.session_id>328</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.406075954437256</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.1800060272216797</time_between_pkts_sum><time_between_pkts_avg>0.1800060272216797</time_between_pkts_avg><time_between_pkts_max>0.1800060272216797</time_between_pkts_max><time_between_pkts_min>0.1800060272216797</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4156144772386808</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4156144772386808</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="655"><ip.session_id>328</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4060819149017334</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4156134476580532</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4156134476580532</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>3011</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>3011</min_tcp_pkts><max_tcp_pkts>3011</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="656"><ip.session_id>329</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4064619541168213</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.3800392150878906</time_between_pkts_sum><time_between_pkts_avg>0.3800392150878906</time_between_pkts_avg><time_between_pkts_max>0.3800392150878906</time_between_pkts_max><time_between_pkts_min>0.3800392150878906</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.41554781212695424</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.41554781212695424</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="657"><ip.session_id>329</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4064691066741943</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.007152557373046875</time_between_pkts_sum><time_between_pkts_avg>0.007152557373046875</time_between_pkts_avg><time_between_pkts_max>0.007152557373046875</time_between_pkts_max><time_between_pkts_min>0.007152557373046875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4155465770271313</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4155465770271313</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>4662</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>4662</min_tcp_pkts><max_tcp_pkts>4662</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="658"><ip.session_id>330</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.406481981277466</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.012874603271484375</time_between_pkts_sum><time_between_pkts_avg>0.012874603271484375</time_between_pkts_avg><time_between_pkts_max>0.012874603271484375</time_between_pkts_max><time_between_pkts_min>0.012874603271484375</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4155443538659518</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4155443538659518</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="659"><ip.session_id>330</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.406486988067627</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.415543489309695</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.415543489309695</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1163</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1163</min_tcp_pkts><max_tcp_pkts>1163</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="660"><ip.session_id>331</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.406611919403076</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.12493133544921875</time_between_pkts_sum><time_between_pkts_avg>0.12493133544921875</time_between_pkts_avg><time_between_pkts_max>0.12493133544921875</time_between_pkts_max><time_between_pkts_min>0.12493133544921875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4155219177373787</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4155219177373787</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="661"><ip.session_id>331</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.406618118286133</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.006198883056640625</time_between_pkts_sum><time_between_pkts_avg>0.006198883056640625</time_between_pkts_avg><time_between_pkts_max>0.006198883056640625</time_between_pkts_max><time_between_pkts_min>0.006198883056640625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.41552084745050766</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.41552084745050766</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>88</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>88</min_tcp_pkts><max_tcp_pkts>88</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="662"><ip.session_id>332</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.406691074371338</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.07295608520507812</time_between_pkts_sum><time_between_pkts_avg>0.07295608520507812</time_between_pkts_avg><time_between_pkts_max>0.07295608520507812</time_between_pkts_max><time_between_pkts_min>0.07295608520507812</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4155082514116251</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4155082514116251</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="663"><ip.session_id>332</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4066970348358154</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4155072223572253</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4155072223572253</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>222</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>222</min_tcp_pkts><max_tcp_pkts>222</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="664"><ip.session_id>333</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.406822919845581</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.125885009765625</time_between_pkts_sum><time_between_pkts_avg>0.125885009765625</time_between_pkts_avg><time_between_pkts_max>0.125885009765625</time_between_pkts_max><time_between_pkts_min>0.125885009765625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.41548548991886736</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.41548548991886736</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="665"><ip.session_id>333</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4068291187286377</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.006198883056640625</time_between_pkts_sum><time_between_pkts_avg>0.006198883056640625</time_between_pkts_avg><time_between_pkts_max>0.006198883056640625</time_between_pkts_max><time_between_pkts_min>0.006198883056640625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.41548441981964684</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.41548441981964684</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>5050</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>5050</min_tcp_pkts><max_tcp_pkts>5050</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="666"><ip.session_id>334</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4078691005706787</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>1.0399818420410156</time_between_pkts_sum><time_between_pkts_avg>1.0399818420410156</time_between_pkts_avg><time_between_pkts_max>1.0399818420410156</time_between_pkts_max><time_between_pkts_min>1.0399818420410156</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4153049680993848</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4153049680993848</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="667"><ip.session_id>334</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4078760147094727</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4153037755644811</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4153037755644811</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>3300</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>3300</min_tcp_pkts><max_tcp_pkts>3300</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="668"><ip.session_id>335</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4080569744110107</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.18095970153808594</time_between_pkts_sum><time_between_pkts_avg>0.18095970153808594</time_between_pkts_avg><time_between_pkts_max>0.18095970153808594</time_between_pkts_max><time_between_pkts_min>0.18095970153808594</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4152725664826062</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4152725664826062</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="669"><ip.session_id>335</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4080629348754883</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.41527153859527605</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.41527153859527605</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>2251</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>2251</min_tcp_pkts><max_tcp_pkts>2251</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="670"><ip.session_id>336</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.408116102218628</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.05316734313964844</time_between_pkts_sum><time_between_pkts_avg>0.05316734313964844</time_between_pkts_avg><time_between_pkts_max>0.05316734313964844</time_between_pkts_max><time_between_pkts_min>0.05316734313964844</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4152623700654164</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4152623700654164</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="671"><ip.session_id>336</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.408128023147583</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.011920928955078125</time_between_pkts_sum><time_between_pkts_avg>0.011920928955078125</time_between_pkts_avg><time_between_pkts_max>0.011920928955078125</time_between_pkts_max><time_between_pkts_min>0.011920928955078125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.41526031439679595</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.41526031439679595</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1175</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1175</min_tcp_pkts><max_tcp_pkts>1175</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="672"><ip.session_id>337</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.408116102218628</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4152623700654164</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4152623700654164</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="673"><ip.session_id>337</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.408134937286377</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.41525912211832144</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.41525912211832144</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>2260</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>2260</min_tcp_pkts><max_tcp_pkts>2260</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="674"><ip.session_id>338</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.408139944076538</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4152582587485277</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4152582587485277</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="675"><ip.session_id>338</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.408147096633911</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.007152557373046875</time_between_pkts_sum><time_between_pkts_avg>0.007152557373046875</time_between_pkts_avg><time_between_pkts_max>0.007152557373046875</time_between_pkts_max><time_between_pkts_min>0.007152557373046875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4152570253693356</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4152570253693356</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1119</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1119</min_tcp_pkts><max_tcp_pkts>1119</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="676"><ip.session_id>339</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.408139944076538</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4152582587485277</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4152582587485277</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="677"><ip.session_id>339</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4081499576568604</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.00286102294921875</time_between_pkts_sum><time_between_pkts_avg>0.00286102294921875</time_between_pkts_avg><time_between_pkts_max>0.00286102294921875</time_between_pkts_max><time_between_pkts_min>0.00286102294921875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4152565320197103</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4152565320197103</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1122</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1122</min_tcp_pkts><max_tcp_pkts>1122</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="678"><ip.session_id>340</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4081950187683105</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.04506111145019531</time_between_pkts_sum><time_between_pkts_avg>0.04506111145019531</time_between_pkts_avg><time_between_pkts_max>0.04506111145019531</time_between_pkts_max><time_between_pkts_min>0.04506111145019531</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.415248761917736</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.415248761917736</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="679"><ip.session_id>340</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.408205032348633</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.010013580322265625</time_between_pkts_sum><time_between_pkts_avg>0.010013580322265625</time_between_pkts_avg><time_between_pkts_max>0.010013580322265625</time_between_pkts_max><time_between_pkts_min>0.010013580322265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4152470352678971</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4152470352678971</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>10628</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>10628</min_tcp_pkts><max_tcp_pkts>10628</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="680"><ip.session_id>341</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4081950187683105</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.415248761917736</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.415248761917736</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="681"><ip.session_id>341</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4082119464874268</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4152458430656743</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4152458430656743</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>3404</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>3404</min_tcp_pkts><max_tcp_pkts>3404</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="682"><ip.session_id>342</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4081950187683105</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.415248761917736</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.415248761917736</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="683"><ip.session_id>342</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.408216953277588</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4152449797510968</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4152449797510968</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>6566</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>6566</min_tcp_pkts><max_tcp_pkts>6566</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="684"><ip.session_id>343</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.408255100250244</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.03814697265625</time_between_pkts_sum><time_between_pkts_avg>0.03814697265625</time_between_pkts_avg><time_between_pkts_max>0.03814697265625</time_between_pkts_max><time_between_pkts_min>0.03814697265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.41523840223408603</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.41523840223408603</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="685"><ip.session_id>343</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.408263921737671</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.008821487426757812</time_between_pkts_sum><time_between_pkts_avg>0.008821487426757812</time_between_pkts_avg><time_between_pkts_max>0.008821487426757812</time_between_pkts_max><time_between_pkts_min>0.008821487426757812</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4152368812129424</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4152368812129424</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>27353</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>27353</min_tcp_pkts><max_tcp_pkts>27353</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="686"><ip.session_id>344</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4082770347595215</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.013113021850585938</time_between_pkts_sum><time_between_pkts_avg>0.013113021850585938</time_between_pkts_avg><time_between_pkts_max>0.013113021850585938</time_between_pkts_max><time_between_pkts_min>0.013113021850585938</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4152346202561596</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4152346202561596</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="687"><ip.session_id>344</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4082839488983154</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4152334281252243</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4152334281252243</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>31038</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>31038</min_tcp_pkts><max_tcp_pkts>31038</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="688"><ip.session_id>345</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4083030223846436</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.019073486328125</time_between_pkts_sum><time_between_pkts_avg>0.019073486328125</time_between_pkts_avg><time_between_pkts_max>0.019073486328125</time_between_pkts_max><time_between_pkts_min>0.019073486328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4152301395236485</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4152301395236485</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="689"><ip.session_id>345</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.408311128616333</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.008106231689453125</time_between_pkts_sum><time_between_pkts_avg>0.008106231689453125</time_between_pkts_avg><time_between_pkts_max>0.008106231689453125</time_between_pkts_max><time_between_pkts_min>0.008106231689453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4152287418837525</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4152287418837525</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>306</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>306</min_tcp_pkts><max_tcp_pkts>306</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="690"><ip.session_id>346</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4083030223846436</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4152301395236485</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4152301395236485</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="691"><ip.session_id>346</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.408318042755127</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4152275497865703</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4152275497865703</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>31337</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>31337</min_tcp_pkts><max_tcp_pkts>31337</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="692"><ip.session_id>347</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.408323049545288</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4152266865480561</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4152266865480561</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="693"><ip.session_id>347</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.408327102661133</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0040531158447265625</time_between_pkts_sum><time_between_pkts_avg>0.0040531158447265625</time_between_pkts_avg><time_between_pkts_max>0.0040531158447265625</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4152259877385545</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4152259877385545</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>4567</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>4567</min_tcp_pkts><max_tcp_pkts>4567</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="694"><ip.session_id>348</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4083399772644043</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.012874603271484375</time_between_pkts_sum><time_between_pkts_avg>0.012874603271484375</time_between_pkts_avg><time_between_pkts_max>0.012874603271484375</time_between_pkts_max><time_between_pkts_min>0.012874603271484375</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4152237680063279</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4152237680063279</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="695"><ip.session_id>348</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4083449840545654</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4152229047835379</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4152229047835379</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>4550</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>4550</min_tcp_pkts><max_tcp_pkts>4550</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="696"><ip.session_id>349</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.408360004425049</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.015020370483398438</time_between_pkts_sum><time_between_pkts_avg>0.015020370483398438</time_between_pkts_avg><time_between_pkts_max>0.015020370483398438</time_between_pkts_max><time_between_pkts_min>0.015020370483398438</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.41522031513670293</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.41522031513670293</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="697"><ip.session_id>349</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.408370018005371</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.010013580322265625</time_between_pkts_sum><time_between_pkts_avg>0.010013580322265625</time_between_pkts_avg><time_between_pkts_max>0.010013580322265625</time_between_pkts_max><time_between_pkts_min>0.010013580322265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.41521858872342504</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.41521858872342504</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>50001</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>50001</min_tcp_pkts><max_tcp_pkts>50001</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="698"><ip.session_id>350</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.408360004425049</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.41522031513670293</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.41522031513670293</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="699"><ip.session_id>350</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.408376932144165</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.41521739668454033</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.41521739668454033</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>6668</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>6668</min_tcp_pkts><max_tcp_pkts>6668</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="700"><ip.session_id>351</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.408360004425049</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.41522031513670293</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.41522031513670293</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="701"><ip.session_id>351</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4083800315856934</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0030994415283203125</time_between_pkts_sum><time_between_pkts_avg>0.0030994415283203125</time_between_pkts_avg><time_between_pkts_max>0.0030994415283203125</time_between_pkts_max><time_between_pkts_min>0.0030994415283203125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4152168623245034</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4152168623245034</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>33354</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>33354</min_tcp_pkts><max_tcp_pkts>33354</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="702"><ip.session_id>352</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4084179401397705</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.03790855407714844</time_between_pkts_sum><time_between_pkts_avg>0.03790855407714844</time_between_pkts_avg><time_between_pkts_max>0.03790855407714844</time_between_pkts_max><time_between_pkts_min>0.03790855407714844</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.41521032680148773</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.41521032680148773</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="703"><ip.session_id>352</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.40842604637146</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.008106231689453125</time_between_pkts_sum><time_between_pkts_avg>0.008106231689453125</time_between_pkts_avg><time_between_pkts_max>0.008106231689453125</time_between_pkts_max><time_between_pkts_min>0.008106231689453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.41520892929496517</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.41520892929496517</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>6901</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>6901</min_tcp_pkts><max_tcp_pkts>6901</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="704"><ip.session_id>353</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4084179401397705</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.41521032680148773</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.41521032680148773</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="705"><ip.session_id>353</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4084320068359375</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.41520790172264144</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.41520790172264144</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>340</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>340</min_tcp_pkts><max_tcp_pkts>340</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="706"><ip.session_id>354</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.408499002456665</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.06699562072753906</time_between_pkts_sum><time_between_pkts_avg>0.06699562072753906</time_between_pkts_avg><time_between_pkts_max>0.06699562072753906</time_between_pkts_max><time_between_pkts_min>0.06699562072753906</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4151963521595822</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4151963521595822</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="707"><ip.session_id>354</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.408508062362671</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.009059906005859375</time_between_pkts_sum><time_between_pkts_avg>0.009059906005859375</time_between_pkts_avg><time_between_pkts_max>0.009059906005859375</time_between_pkts_max><time_between_pkts_min>0.009059906005859375</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4151947903462824</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4151947903462824</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>2869</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>2869</min_tcp_pkts><max_tcp_pkts>2869</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="708"><ip.session_id>355</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.408513069152832</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4151939272439734</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4151939272439734</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="709"><ip.session_id>355</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.408519983291626</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.41519273534668405</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.41519273534668405</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>3323</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>3323</min_tcp_pkts><max_tcp_pkts>3323</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="710"><ip.session_id>356</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.408536911010742</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.016927719116210938</time_between_pkts_sum><time_between_pkts_avg>0.016927719116210938</time_between_pkts_avg><time_between_pkts_max>0.016927719116210938</time_between_pkts_max><time_between_pkts_min>0.016927719116210938</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.41518981728220644</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.41518981728220644</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="711"><ip.session_id>356</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4085469245910645</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.010013580322265625</time_between_pkts_sum><time_between_pkts_avg>0.010013580322265625</time_between_pkts_avg><time_between_pkts_max>0.010013580322265625</time_between_pkts_max><time_between_pkts_min>0.010013580322265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.41518809112252825</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.41518809112252825</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>5500</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>5500</min_tcp_pkts><max_tcp_pkts>5500</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="712"><ip.session_id>357</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.408536911010742</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.41518981728220644</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.41518981728220644</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="713"><ip.session_id>357</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4085540771484375</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.007152557373046875</time_between_pkts_sum><time_between_pkts_avg>0.007152557373046875</time_between_pkts_avg><time_between_pkts_max>0.007152557373046875</time_between_pkts_max><time_between_pkts_min>0.007152557373046875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4151868581601171</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4151868581601171</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>801</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>801</min_tcp_pkts><max_tcp_pkts>801</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="714"><ip.session_id>358</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4085569381713867</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.00286102294921875</time_between_pkts_sum><time_between_pkts_avg>0.00286102294921875</time_between_pkts_avg><time_between_pkts_max>0.00286102294921875</time_between_pkts_max><time_between_pkts_min>0.00286102294921875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.415186364977203</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.415186364977203</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="715"><ip.session_id>358</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4085609912872314</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0040531158447265625</time_between_pkts_sum><time_between_pkts_avg>0.0040531158447265625</time_between_pkts_avg><time_between_pkts_max>0.0040531158447265625</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4151856663034138</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4151856663034138</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1352</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1352</min_tcp_pkts><max_tcp_pkts>1352</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="716"><ip.session_id>359</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4086639881134033</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.102996826171875</time_between_pkts_sum><time_between_pkts_avg>0.102996826171875</time_between_pkts_avg><time_between_pkts_max>0.102996826171875</time_between_pkts_max><time_between_pkts_min>0.102996826171875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4151679125585526</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4151679125585526</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="717"><ip.session_id>359</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4086709022521973</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4151667208106191</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4151667208106191</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>49152</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>49152</min_tcp_pkts><max_tcp_pkts>49152</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="718"><ip.session_id>360</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4086639881134033</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4151679125585526</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4151679125585526</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="719"><ip.session_id>360</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.408677101135254</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.006198883056640625</time_between_pkts_sum><time_between_pkts_avg>0.006198883056640625</time_between_pkts_avg><time_between_pkts_max>0.006198883056640625</time_between_pkts_max><time_between_pkts_min>0.006198883056640625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.41516565235277136</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.41516565235277136</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>9001</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>9001</min_tcp_pkts><max_tcp_pkts>9001</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="720"><ip.session_id>361</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4087250232696533</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.04792213439941406</time_between_pkts_sum><time_between_pkts_avg>0.04792213439941406</time_between_pkts_avg><time_between_pkts_max>0.04792213439941406</time_between_pkts_max><time_between_pkts_min>0.04792213439941406</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.41515739253730977</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.41515739253730977</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="721"><ip.session_id>361</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4087350368499756</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.010013580322265625</time_between_pkts_sum><time_between_pkts_avg>0.010013580322265625</time_between_pkts_avg><time_between_pkts_max>0.010013580322265625</time_between_pkts_max><time_between_pkts_min>0.010013580322265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4151556666472334</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4151556666472334</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>109</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>109</min_tcp_pkts><max_tcp_pkts>109</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="722"><ip.session_id>362</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4087250232696533</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.41515739253730977</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.41515739253730977</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="723"><ip.session_id>362</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4087419509887695</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.41515447496960306</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.41515447496960306</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1030</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1030</min_tcp_pkts><max_tcp_pkts>1030</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="724"><ip.session_id>363</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4087460041046143</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0040531158447265625</time_between_pkts_sum><time_between_pkts_avg>0.0040531158447265625</time_between_pkts_avg><time_between_pkts_max>0.0040531158447265625</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.41515377640313833</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.41515377640313833</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="725"><ip.session_id>363</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.408752918243408</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.41515258473635963</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.41515258473635963</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>3000</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>3000</min_tcp_pkts><max_tcp_pkts>3000</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="726"><ip.session_id>364</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4087469577789307</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.00095367431640625</time_between_pkts_sum><time_between_pkts_avg>0.00095367431640625</time_between_pkts_avg><time_between_pkts_max>0.00095367431640625</time_between_pkts_max><time_between_pkts_min>0.00095367431640625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4151536120349001</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4151536120349001</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="727"><ip.session_id>364</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4087560176849365</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0030994415283203125</time_between_pkts_sum><time_between_pkts_avg>0.0030994415283203125</time_between_pkts_avg><time_between_pkts_max>0.0030994415283203125</time_between_pkts_max><time_between_pkts_min>0.0030994415283203125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4151520505431278</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4151520505431278</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1106</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1106</min_tcp_pkts><max_tcp_pkts>1106</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="728"><ip.session_id>365</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4087679386138916</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.011920928955078125</time_between_pkts_sum><time_between_pkts_avg>0.011920928955078125</time_between_pkts_avg><time_between_pkts_max>0.011920928955078125</time_between_pkts_max><time_between_pkts_min>0.011920928955078125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4151499959665865</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4151499959665865</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="729"><ip.session_id>365</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4087769985198975</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.008106231689453125</time_between_pkts_sum><time_between_pkts_avg>0.008106231689453125</time_between_pkts_avg><time_between_pkts_max>0.008106231689453125</time_between_pkts_max><time_between_pkts_min>0.008106231689453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4151484345020159</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4151484345020159</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>2144</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>2144</min_tcp_pkts><max_tcp_pkts>2144</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="730"><ip.session_id>366</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.408768892288208</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.00095367431640625</time_between_pkts_sum><time_between_pkts_avg>0.00095367431640625</time_between_pkts_avg><time_between_pkts_max>0.00095367431640625</time_between_pkts_max><time_between_pkts_min>0.00095367431640625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4151498316013417</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4151498316013417</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="731"><ip.session_id>366</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4087820053100586</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.41514757159242394</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.41514757159242394</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>9102</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>9102</min_tcp_pkts><max_tcp_pkts>9102</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="732"><ip.session_id>367</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.408768892288208</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4151498316013417</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4151498316013417</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="733"><ip.session_id>367</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.408785104751587</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0030994415283203125</time_between_pkts_sum><time_between_pkts_avg>0.0030994415283203125</time_between_pkts_avg><time_between_pkts_max>0.0030994415283203125</time_between_pkts_max><time_between_pkts_min>0.0030994415283203125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.41514703741209324</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.41514703741209324</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>301</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>301</min_tcp_pkts><max_tcp_pkts>301</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="734"><ip.session_id>368</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.408797025680542</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.011920928955078125</time_between_pkts_sum><time_between_pkts_avg>0.011920928955078125</time_between_pkts_avg><time_between_pkts_max>0.011920928955078125</time_between_pkts_max><time_between_pkts_min>0.011920928955078125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.41514498288517127</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.41514498288517127</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="735"><ip.session_id>368</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4088029861450195</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.415143955629336</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.415143955629336</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1072</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1072</min_tcp_pkts><max_tcp_pkts>1072</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="736"><ip.session_id>369</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.408797025680542</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.41514498288517127</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.41514498288517127</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="737"><ip.session_id>369</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4088079929351807</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4151430927383631</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4151430927383631</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>27355</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>27355</min_tcp_pkts><max_tcp_pkts>27355</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="738"><ip.session_id>370</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.408813953399658</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.415142065491882</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.415142065491882</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="739"><ip.session_id>370</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.408818006515503</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0040531158447265625</time_between_pkts_sum><time_between_pkts_avg>0.0040531158447265625</time_between_pkts_avg><time_between_pkts_max>0.0040531158447265625</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.41514136696717857</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.41514136696717857</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>464</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>464</min_tcp_pkts><max_tcp_pkts>464</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="740"><ip.session_id>371</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4088449478149414</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.026941299438476562</time_between_pkts_sum><time_between_pkts_avg>0.026941299438476562</time_between_pkts_avg><time_between_pkts_max>0.026941299438476562</time_between_pkts_max><time_between_pkts_min>0.026941299438476562</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.41513672389212847</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.41513672389212847</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="741"><ip.session_id>371</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.408853054046631</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.008106231689453125</time_between_pkts_sum><time_between_pkts_avg>0.008106231689453125</time_between_pkts_avg><time_between_pkts_max>0.008106231689453125</time_between_pkts_max><time_between_pkts_min>0.008106231689453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.41513532688102356</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.41513532688102356</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>5999</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>5999</min_tcp_pkts><max_tcp_pkts>5999</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="742"><ip.session_id>372</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4088449478149414</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.41513672389212847</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.41513672389212847</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="743"><ip.session_id>372</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.408858060836792</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4151344640259206</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4151344640259206</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>2608</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>2608</min_tcp_pkts><max_tcp_pkts>2608</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="744"><ip.session_id>373</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4088621139526367</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0040531158447265625</time_between_pkts_sum><time_between_pkts_avg>0.0040531158447265625</time_between_pkts_avg><time_between_pkts_max>0.0040531158447265625</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.41513376552679765</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.41513376552679765</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="745"><ip.session_id>373</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4088680744171143</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4151327383264752</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4151327383264752</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1113</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1113</min_tcp_pkts><max_tcp_pkts>1113</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="746"><ip.session_id>374</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4088621139526367</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.41513376552679765</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.41513376552679765</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="747"><ip.session_id>374</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4088730812072754</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4151318754821327</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4151318754821327</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1434</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1434</min_tcp_pkts><max_tcp_pkts>1434</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="748"><ip.session_id>375</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.408879041671753</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4151308482911636</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4151308482911636</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="749"><ip.session_id>375</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.408884048461914</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4151299854546779</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4151299854546779</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>2525</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>2525</min_tcp_pkts><max_tcp_pkts>2525</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="750"><ip.session_id>376</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4089109897613525</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.026941299438476562</time_between_pkts_sum><time_between_pkts_avg>0.026941299438476562</time_between_pkts_avg><time_between_pkts_max>0.026941299438476562</time_between_pkts_max><time_between_pkts_min>0.026941299438476562</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4151253426342119</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4151253426342119</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="751"><ip.session_id>376</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4089200496673584</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.009059906005859375</time_between_pkts_sum><time_between_pkts_avg>0.009059906005859375</time_between_pkts_avg><time_between_pkts_max>0.009059906005859375</time_between_pkts_max><time_between_pkts_min>0.009059906005859375</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.41512378135508793</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.41512378135508793</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1863</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1863</min_tcp_pkts><max_tcp_pkts>1863</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="752"><ip.session_id>377</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4089109897613525</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4151253426342119</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4151253426342119</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="753"><ip.session_id>377</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4089269638061523</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4151225898604996</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4151225898604996</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>16016</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>16016</min_tcp_pkts><max_tcp_pkts>16016</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="754"><ip.session_id>378</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.408931016921997</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0040531158447265625</time_between_pkts_sum><time_between_pkts_avg>0.0040531158447265625</time_between_pkts_avg><time_between_pkts_max>0.0040531158447265625</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4151218914013347</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4151218914013347</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="755"><ip.session_id>378</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.408935070037842</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0040531158447265625</time_between_pkts_sum><time_between_pkts_avg>0.0040531158447265625</time_between_pkts_avg><time_between_pkts_max>0.0040531158447265625</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4151211929445201</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4151211929445201</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>9575</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>9575</min_tcp_pkts><max_tcp_pkts>9575</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="756"><ip.session_id>379</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4089529514312744</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.017881393432617188</time_between_pkts_sum><time_between_pkts_avg>0.017881393432617188</time_between_pkts_avg><time_between_pkts_max>0.017881393432617188</time_between_pkts_max><time_between_pkts_min>0.017881393432617188</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.41511811154545464</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.41511811154545464</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="757"><ip.session_id>379</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4089579582214355</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.41511724876191397</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.41511724876191397</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>2160</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>2160</min_tcp_pkts><max_tcp_pkts>2160</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="758"><ip.session_id>380</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4089629650115967</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.41511638598195966</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.41511638598195966</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="759"><ip.session_id>380</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.408967971801758</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4151155232055918</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4151155232055918</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>5985</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>5985</min_tcp_pkts><max_tcp_pkts>5985</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="760"><ip.session_id>381</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4090120792388916</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.04410743713378906</time_between_pkts_sum><time_between_pkts_avg>0.04410743713378906</time_between_pkts_avg><time_between_pkts_max>0.04410743713378906</time_between_pkts_max><time_between_pkts_min>0.04410743713378906</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4151079227115964</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4151079227115964</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="761"><ip.session_id>381</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.409018039703369</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.41510689563915987</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.41510689563915987</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>2035</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>2035</min_tcp_pkts><max_tcp_pkts>2035</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="762"><ip.session_id>382</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4401190280914307</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>31.100988388061523</time_between_pkts_sum><time_between_pkts_avg>31.100988388061523</time_between_pkts_avg><time_between_pkts_max>31.100988388061523</time_between_pkts_max><time_between_pkts_min>31.100988388061523</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40981607392413244</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40981607392413244</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="763"><ip.session_id>382</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4401400089263916</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0209808349609375</time_between_pkts_sum><time_between_pkts_avg>0.0209808349609375</time_between_pkts_avg><time_between_pkts_max>0.0209808349609375</time_between_pkts_max><time_between_pkts_min>0.0209808349609375</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40981255023968</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40981255023968</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>55555</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>55555</min_tcp_pkts><max_tcp_pkts>55555</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="764"><ip.session_id>383</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.440181016921997</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.04100799560546875</time_between_pkts_sum><time_between_pkts_avg>0.04100799560546875</time_between_pkts_avg><time_between_pkts_max>0.04100799560546875</time_between_pkts_max><time_between_pkts_min>0.04100799560546875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40980566321320827</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40980566321320827</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="765"><ip.session_id>383</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.440187931060791</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40980450205131663</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40980450205131663</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>32784</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>32784</min_tcp_pkts><max_tcp_pkts>32784</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="766"><ip.session_id>384</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.440181016921997</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40980566321320827</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40980566321320827</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="767"><ip.session_id>384</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.440195083618164</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.007152557373046875</time_between_pkts_sum><time_between_pkts_avg>0.007152557373046875</time_between_pkts_avg><time_between_pkts_max>0.007152557373046875</time_between_pkts_max><time_between_pkts_min>0.007152557373046875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4098033008562842</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4098033008562842</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>987</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>987</min_tcp_pkts><max_tcp_pkts>987</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="768"><ip.session_id>385</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4401988983154297</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.003814697265625</time_between_pkts_sum><time_between_pkts_avg>0.003814697265625</time_between_pkts_avg><time_between_pkts_max>0.003814697265625</time_between_pkts_max><time_between_pkts_min>0.003814697265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40980266022181283</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40980266022181283</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="769"><ip.session_id>385</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.440203905105591</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4098018193921088</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4098018193921088</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>3814</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>3814</min_tcp_pkts><max_tcp_pkts>3814</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="770"><ip.session_id>386</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.440208911895752</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40980097856585523</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40980097856585523</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="771"><ip.session_id>386</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.440213918685913</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4098001377430521</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4098001377430521</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1296</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1296</min_tcp_pkts><max_tcp_pkts>1296</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="772"><ip.session_id>387</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.440321922302246</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.10800361633300781</time_between_pkts_sum><time_between_pkts_avg>0.10800361633300781</time_between_pkts_avg><time_between_pkts_max>0.10800361633300781</time_between_pkts_max><time_between_pkts_min>0.10800361633300781</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40978200083396416</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40978200083396416</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="773"><ip.session_id>387</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4403281211853027</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.006198883056640625</time_between_pkts_sum><time_between_pkts_avg>0.006198883056640625</time_between_pkts_avg><time_between_pkts_max>0.006198883056640625</time_between_pkts_max><time_between_pkts_min>0.006198883056640625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40978095991217994</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40978095991217994</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>2701</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>2701</min_tcp_pkts><max_tcp_pkts>2701</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="774"><ip.session_id>388</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.440403938293457</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.07581710815429688</time_between_pkts_sum><time_between_pkts_avg>0.07581710815429688</time_between_pkts_avg><time_between_pkts_max>0.07581710815429688</time_between_pkts_max><time_between_pkts_min>0.07581710815429688</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4097682290659173</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4097682290659173</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="775"><ip.session_id>388</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4404120445251465</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.008106231689453125</time_between_pkts_sum><time_between_pkts_avg>0.008106231689453125</time_between_pkts_avg><time_between_pkts_max>0.008106231689453125</time_between_pkts_max><time_between_pkts_min>0.008106231689453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40976686795306294</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40976686795306294</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>5030</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>5030</min_tcp_pkts><max_tcp_pkts>5030</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="776"><ip.session_id>389</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4404170513153076</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4097660272702289</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4097660272702289</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="777"><ip.session_id>389</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4404239654541016</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4097648663329386</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4097648663329386</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>9943</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>9943</min_tcp_pkts><max_tcp_pkts>9943</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="778"><ip.session_id>390</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4404170513153076</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4097660272702289</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4097660272702289</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="779"><ip.session_id>390</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4404289722442627</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4097640256583177</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4097640256583177</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>3766</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>3766</min_tcp_pkts><max_tcp_pkts>3766</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="780"><ip.session_id>391</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.440433979034424</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40976318498714626</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40976318498714626</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="781"><ip.session_id>391</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.440438985824585</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4097623443194242</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4097623443194242</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1032</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1032</min_tcp_pkts><max_tcp_pkts>1032</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="782"><ip.session_id>392</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4404640197753906</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.025033950805664062</time_between_pkts_sum><time_between_pkts_avg>0.025033950805664062</time_between_pkts_avg><time_between_pkts_max>0.025033950805664062</time_between_pkts_max><time_between_pkts_min>0.025033950805664062</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40975814103255476</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40975814103255476</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="783"><ip.session_id>392</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4404709339141846</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4097569801399501</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4097569801399501</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>8994</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>8994</min_tcp_pkts><max_tcp_pkts>8994</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="784"><ip.session_id>393</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4404640197753906</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40975814103255476</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40975814103255476</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="785"><ip.session_id>393</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.440476894378662</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4097559793757428</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4097559793757428</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1011</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1011</min_tcp_pkts><max_tcp_pkts>1011</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="786"><ip.session_id>394</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.440531015396118</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.05412101745605469</time_between_pkts_sum><time_between_pkts_avg>0.05412101745605469</time_between_pkts_avg><time_between_pkts_max>0.05412101745605469</time_between_pkts_max><time_between_pkts_min>0.05412101745605469</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40974689266044495</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40974689266044495</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="787"><ip.session_id>394</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.440541982650757</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.010967254638671875</time_between_pkts_sum><time_between_pkts_avg>0.010967254638671875</time_between_pkts_avg><time_between_pkts_max>0.010967254638671875</time_between_pkts_max><time_between_pkts_min>0.010967254638671875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40974505134874406</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40974505134874406</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>2034</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>2034</min_tcp_pkts><max_tcp_pkts>2034</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="788"><ip.session_id>395</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.440546989440918</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40974421075542605</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40974421075542605</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="789"><ip.session_id>395</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.440551996231079</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40974337016555695</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40974337016555695</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1082</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1082</min_tcp_pkts><max_tcp_pkts>1082</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="790"><ip.session_id>396</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4405570030212402</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4097425295791368</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4097425295791368</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="791"><ip.session_id>396</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.440561056137085</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0040531158447265625</time_between_pkts_sum><time_between_pkts_avg>0.0040531158447265625</time_between_pkts_avg><time_between_pkts_max>0.0040531158447265625</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4097418491069418</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4097418491069418</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>3351</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>3351</min_tcp_pkts><max_tcp_pkts>3351</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="792"><ip.session_id>397</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4405810832977295</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.02002716064453125</time_between_pkts_sum><time_between_pkts_avg>0.02002716064453125</time_between_pkts_avg><time_between_pkts_max>0.02002716064453125</time_between_pkts_max><time_between_pkts_min>0.02002716064453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4097384868069178</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4097384868069178</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="793"><ip.session_id>397</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.440587043762207</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4097374861330423</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4097374861330423</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>5902</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>5902</min_tcp_pkts><max_tcp_pkts>5902</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="794"><ip.session_id>398</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.440721035003662</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.13399124145507812</time_between_pkts_sum><time_between_pkts_avg>0.13399124145507812</time_between_pkts_avg><time_between_pkts_max>0.13399124145507812</time_between_pkts_max><time_between_pkts_min>0.13399124145507812</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40971499227419883</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40971499227419883</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="795"><ip.session_id>398</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4407269954681396</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4097139917150778</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4097139917150778</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>5986</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>5986</min_tcp_pkts><max_tcp_pkts>5986</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="796"><ip.session_id>399</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4407551288604736</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.028133392333984375</time_between_pkts_sum><time_between_pkts_avg>0.028133392333984375</time_between_pkts_avg><time_between_pkts_max>0.028133392333984375</time_between_pkts_max><time_between_pkts_min>0.028133392333984375</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4097092691419948</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4097092691419948</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="797"><ip.session_id>399</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.440762996673584</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.007867813110351562</time_between_pkts_sum><time_between_pkts_avg>0.007867813110351562</time_between_pkts_avg><time_between_pkts_max>0.007867813110351562</time_between_pkts_max><time_between_pkts_min>0.007867813110351562</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4097079484418844</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4097079484418844</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>64623</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>64623</min_tcp_pkts><max_tcp_pkts>64623</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="798"><ip.session_id>400</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4407551288604736</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4097092691419948</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4097092691419948</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="799"><ip.session_id>400</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4407689571380615</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4097069479171663</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4097069479171663</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1029</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1029</min_tcp_pkts><max_tcp_pkts>1029</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="800"><ip.session_id>401</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.440793991088867</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.025033950805664062</time_between_pkts_sum><time_between_pkts_avg>0.025033950805664062</time_between_pkts_avg><time_between_pkts_max>0.025033950805664062</time_between_pkts_max><time_between_pkts_min>0.025033950805664062</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4097027457667118</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4097027457667118</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="801"><ip.session_id>401</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.440803050994873</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.009059906005859375</time_between_pkts_sum><time_between_pkts_avg>0.009059906005859375</time_between_pkts_avg><time_between_pkts_max>0.009059906005859375</time_between_pkts_max><time_between_pkts_min>0.009059906005859375</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4097012250096948</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4097012250096948</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>9485</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>9485</min_tcp_pkts><max_tcp_pkts>9485</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="802"><ip.session_id>402</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.440793991088867</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4097027457667118</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4097027457667118</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="803"><ip.session_id>402</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.440809965133667</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40970006443956675</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40970006443956675</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>99</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>99</min_tcp_pkts><max_tcp_pkts>99</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="804"><ip.session_id>403</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4408140182495117</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0040531158447265625</time_between_pkts_sum><time_between_pkts_avg>0.0040531158447265625</time_between_pkts_avg><time_between_pkts_max>0.0040531158447265625</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40969938410841067</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40969938410841067</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="805"><ip.session_id>403</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4408199787139893</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.409698383625521</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.409698383625521</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1259</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1259</min_tcp_pkts><max_tcp_pkts>1259</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="806"><ip.session_id>404</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4408249855041504</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40969754322366986</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40969754322366986</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="807"><ip.session_id>404</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.440829038619995</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0040531158447265625</time_between_pkts_sum><time_between_pkts_avg>0.0040531158447265625</time_between_pkts_avg><time_between_pkts_max>0.0040531158447265625</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.409696862900887</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.409696862900887</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>777</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>777</min_tcp_pkts><max_tcp_pkts>777</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="808"><ip.session_id>405</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.44084095954895</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.011920928955078125</time_between_pkts_sum><time_between_pkts_avg>0.011920928955078125</time_between_pkts_avg><time_between_pkts_max>0.011920928955078125</time_between_pkts_max><time_between_pkts_min>0.011920928955078125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4096948619646209</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4096948619646209</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="809"><ip.session_id>405</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4408469200134277</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4096938615038172</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4096938615038172</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>10243</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>10243</min_tcp_pkts><max_tcp_pkts>10243</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="810"><ip.session_id>406</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4409639835357666</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.11706352233886719</time_between_pkts_sum><time_between_pkts_avg>0.11706352233886719</time_between_pkts_avg><time_between_pkts_max>0.11706352233886719</time_between_pkts_max><time_between_pkts_min>0.11706352233886719</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4096742134439393</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4096742134439393</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="811"><ip.session_id>406</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.440972089767456</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.008106231689453125</time_between_pkts_sum><time_between_pkts_avg>0.008106231689453125</time_between_pkts_avg><time_between_pkts_max>0.008106231689453125</time_between_pkts_max><time_between_pkts_min>0.008106231689453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4096728529555891</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4096728529555891</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>90</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>90</min_tcp_pkts><max_tcp_pkts>90</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="812"><ip.session_id>407</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.440977096557617</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40967201265847514</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40967201265847514</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="813"><ip.session_id>407</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.440984010696411</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4096708522538419</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4096708522538419</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>9101</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>9101</min_tcp_pkts><max_tcp_pkts>9101</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="814"><ip.session_id>408</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.440977096557617</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40967201265847514</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40967201265847514</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="815"><ip.session_id>408</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.440990924835205</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4096696918557825</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4096696918557825</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>2604</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>2604</min_tcp_pkts><max_tcp_pkts>2604</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="816"><ip.session_id>409</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4410059452056885</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.015020370483398438</time_between_pkts_sum><time_between_pkts_avg>0.015020370483398438</time_between_pkts_avg><time_between_pkts_max>0.015020370483398438</time_between_pkts_max><time_between_pkts_min>0.015020370483398438</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40966717101368477</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40966717101368477</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="817"><ip.session_id>409</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4410159587860107</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.010013580322265625</time_between_pkts_sum><time_between_pkts_avg>0.010013580322265625</time_between_pkts_avg><time_between_pkts_max>0.010013580322265625</time_between_pkts_max><time_between_pkts_min>0.010013580322265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40966549046952133</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40966549046952133</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>4998</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>4998</min_tcp_pkts><max_tcp_pkts>4998</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="818"><ip.session_id>410</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4410059452056885</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40966717101368477</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40966717101368477</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="819"><ip.session_id>410</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.441023111343384</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.007152557373046875</time_between_pkts_sum><time_between_pkts_avg>0.007152557373046875</time_between_pkts_avg><time_between_pkts_max>0.007152557373046875</time_between_pkts_max><time_between_pkts_min>0.007152557373046875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40966429008927474</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40966429008927474</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>100</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>100</min_tcp_pkts><max_tcp_pkts>100</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="820"><ip.session_id>411</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4410269260406494</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.003814697265625</time_between_pkts_sum><time_between_pkts_avg>0.003814697265625</time_between_pkts_avg><time_between_pkts_max>0.003814697265625</time_between_pkts_max><time_between_pkts_min>0.003814697265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40966364988935294</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40966364988935294</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="821"><ip.session_id>411</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4410319328308105</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4096628096299921</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4096628096299921</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>82</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>82</min_tcp_pkts><max_tcp_pkts>82</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="822"><ip.session_id>412</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4410910606384277</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0591278076171875</time_between_pkts_sum><time_between_pkts_avg>0.0591278076171875</time_between_pkts_avg><time_between_pkts_max>0.0591278076171875</time_between_pkts_max><time_between_pkts_min>0.0591278076171875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4096528868277721</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4096528868277721</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="823"><ip.session_id>412</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4410979747772217</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4096517265314849</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4096517265314849</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>6839</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>6839</min_tcp_pkts><max_tcp_pkts>6839</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="824"><ip.session_id>413</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4411239624023438</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.025987625122070312</time_between_pkts_sum><time_between_pkts_avg>0.025987625122070312</time_between_pkts_avg><time_between_pkts_max>0.025987625122070312</time_between_pkts_max><time_between_pkts_min>0.025987625122070312</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4096473654766332</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4096473654766332</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="825"><ip.session_id>413</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.441128969192505</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4096465252840728</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4096465252840728</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>255</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>255</min_tcp_pkts><max_tcp_pkts>255</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="826"><ip.session_id>414</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4418818950653076</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.7529258728027344</time_between_pkts_sum><time_between_pkts_avg>0.7529258728027344</time_between_pkts_avg><time_between_pkts_max>0.7529258728027344</time_between_pkts_max><time_between_pkts_min>0.7529258728027344</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4095202155439443</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4095202155439443</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="827"><ip.session_id>414</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.441927909851074</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.04601478576660156</time_between_pkts_sum><time_between_pkts_avg>0.04601478576660156</time_between_pkts_avg><time_between_pkts_max>0.04601478576660156</time_between_pkts_max><time_between_pkts_min>0.04601478576660156</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4095124986965676</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4095124986965676</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>55600</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>55600</min_tcp_pkts><max_tcp_pkts>55600</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="828"><ip.session_id>415</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.442009925842285</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0820159912109375</time_between_pkts_sum><time_between_pkts_avg>0.0820159912109375</time_between_pkts_avg><time_between_pkts_max>0.0820159912109375</time_between_pkts_max><time_between_pkts_min>0.0820159912109375</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4094987450368717</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4094987450368717</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="829"><ip.session_id>415</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.442020893096924</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.010967254638671875</time_between_pkts_sum><time_between_pkts_avg>0.010967254638671875</time_between_pkts_avg><time_between_pkts_max>0.010967254638671875</time_between_pkts_max><time_between_pkts_min>0.010967254638671875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4094969059547313</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4094969059547313</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>5963</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>5963</min_tcp_pkts><max_tcp_pkts>5963</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="830"><ip.session_id>416</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.442025899887085</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4094960663792461</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4094960663792461</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="831"><ip.session_id>416</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.442030906677246</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4094952268072036</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4094952268072036</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>5214</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>5214</min_tcp_pkts><max_tcp_pkts>5214</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="832"><ip.session_id>417</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4420530796051025</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.022172927856445312</time_between_pkts_sum><time_between_pkts_avg>0.022172927856445312</time_between_pkts_avg><time_between_pkts_max>0.022172927856445312</time_between_pkts_max><time_between_pkts_min>0.022172927856445312</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40949150874382595</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40949150874382595</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="833"><ip.session_id>417</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4420599937438965</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4094903493615284</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4094903493615284</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>20031</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>20031</min_tcp_pkts><max_tcp_pkts>20031</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="834"><ip.session_id>418</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4421169757843018</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.05698204040527344</time_between_pkts_sum><time_between_pkts_avg>0.05698204040527344</time_between_pkts_avg><time_between_pkts_max>0.05698204040527344</time_between_pkts_max><time_between_pkts_min>0.05698204040527344</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40948079470224535</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40948079470224535</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="835"><ip.session_id>418</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4421229362487793</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40947979528665707</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40947979528665707</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>65000</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>65000</min_tcp_pkts><max_tcp_pkts>65000</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="836"><ip.session_id>419</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4421510696411133</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.028133392333984375</time_between_pkts_sum><time_between_pkts_avg>0.028133392333984375</time_between_pkts_avg><time_between_pkts_max>0.028133392333984375</time_between_pkts_max><time_between_pkts_min>0.028133392333984375</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4094750781109357</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4094750781109357</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="837"><ip.session_id>419</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4421579837799072</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40947391882167533</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40947391882167533</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>6567</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>6567</min_tcp_pkts><max_tcp_pkts>6567</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="838"><ip.session_id>420</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.442171096801758</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.013113021850585938</time_between_pkts_sum><time_between_pkts_avg>0.013113021850585938</time_between_pkts_avg><time_between_pkts_max>0.013113021850585938</time_between_pkts_max><time_between_pkts_min>0.013113021850585938</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40947172018766</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40947172018766</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="839"><ip.session_id>420</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.442176103591919</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4094708807154463</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4094708807154463</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>2065</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>2065</min_tcp_pkts><max_tcp_pkts>2065</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="840"><ip.session_id>421</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.442215919494629</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.03981590270996094</time_between_pkts_sum><time_between_pkts_avg>0.03981590270996094</time_between_pkts_avg><time_between_pkts_max>0.03981590270996094</time_between_pkts_max><time_between_pkts_min>0.03981590270996094</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40946420503512704</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40946420503512704</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="841"><ip.session_id>421</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.44222092628479</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40946336559372715</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40946336559372715</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>545</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>545</min_tcp_pkts><max_tcp_pkts>545</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="842"><ip.session_id>422</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4422271251678467</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.006198883056640625</time_between_pkts_sum><time_between_pkts_avg>0.006198883056640625</time_between_pkts_avg><time_between_pkts_max>0.006198883056640625</time_between_pkts_max><time_between_pkts_min>0.006198883056640625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.409462326290096</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.409462326290096</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="843"><ip.session_id>422</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4422318935394287</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.00476837158203125</time_between_pkts_sum><time_between_pkts_avg>0.00476837158203125</time_between_pkts_avg><time_between_pkts_max>0.00476837158203125</time_between_pkts_max><time_between_pkts_min>0.00476837158203125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4094615268293545</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4094615268293545</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>8649</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>8649</min_tcp_pkts><max_tcp_pkts>8649</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="844"><ip.session_id>423</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4423038959503174</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.07200241088867188</time_between_pkts_sum><time_between_pkts_avg>0.07200241088867188</time_between_pkts_avg><time_between_pkts_max>0.07200241088867188</time_between_pkts_max><time_between_pkts_min>0.07200241088867188</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4094494553516212</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4094494553516212</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="845"><ip.session_id>423</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.442310094833374</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.006198883056640625</time_between_pkts_sum><time_between_pkts_avg>0.006198883056640625</time_between_pkts_avg><time_between_pkts_max>0.006198883056640625</time_between_pkts_max><time_between_pkts_min>0.006198883056640625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40944841611860294</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40944841611860294</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>646</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>646</min_tcp_pkts><max_tcp_pkts>646</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="846"><ip.session_id>424</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.442337989807129</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.027894973754882812</time_between_pkts_sum><time_between_pkts_avg>0.027894973754882812</time_between_pkts_avg><time_between_pkts_max>0.027894973754882812</time_between_pkts_max><time_between_pkts_min>0.027894973754882812</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4094437396353032</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4094437396353032</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="847"><ip.session_id>424</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4423460960388184</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.008106231689453125</time_between_pkts_sum><time_between_pkts_avg>0.008106231689453125</time_between_pkts_avg><time_between_pkts_max>0.008106231689453125</time_between_pkts_max><time_between_pkts_min>0.008106231689453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4094423806772822</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4094423806772822</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>3031</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>3031</min_tcp_pkts><max_tcp_pkts>3031</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="848"><ip.session_id>425</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.442352056503296</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40944138144919834</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40944138144919834</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="849"><ip.session_id>425</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4423561096191406</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0040531158447265625</time_between_pkts_sum><time_between_pkts_avg>0.0040531158447265625</time_between_pkts_avg><time_between_pkts_max>0.0040531158447265625</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40944070197688714</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40944070197688714</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>32770</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>32770</min_tcp_pkts><max_tcp_pkts>32770</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="850"><ip.session_id>426</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.442375898361206</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.019788742065429688</time_between_pkts_sum><time_between_pkts_avg>0.019788742065429688</time_between_pkts_avg><time_between_pkts_max>0.019788742065429688</time_between_pkts_max><time_between_pkts_min>0.019788742065429688</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40943738458563383</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40943738458563383</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="851"><ip.session_id>426</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4423820972442627</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.006198883056640625</time_between_pkts_sum><time_between_pkts_avg>0.006198883056640625</time_between_pkts_avg><time_between_pkts_max>0.006198883056640625</time_between_pkts_max><time_between_pkts_min>0.006198883056640625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4094363454138888</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4094363454138888</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>11111</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>11111</min_tcp_pkts><max_tcp_pkts>11111</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="852"><ip.session_id>427</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4424049854278564</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.02288818359375</time_between_pkts_sum><time_between_pkts_avg>0.02288818359375</time_between_pkts_avg><time_between_pkts_max>0.02288818359375</time_between_pkts_max><time_between_pkts_min>0.02288818359375</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40943250851775576</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40943250851775576</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="853"><ip.session_id>427</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.442410945892334</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4094315093378565</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4094315093378565</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>6123</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>6123</min_tcp_pkts><max_tcp_pkts>6123</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="854"><ip.session_id>428</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4424350261688232</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.024080276489257812</time_between_pkts_sum><time_between_pkts_avg>0.024080276489257812</time_between_pkts_avg><time_between_pkts_max>0.024080276489257812</time_between_pkts_max><time_between_pkts_min>0.024080276489257812</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40942747270071256</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40942747270071256</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="855"><ip.session_id>428</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.442441940307617</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40942631368099314</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40942631368099314</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>9103</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>9103</min_tcp_pkts><max_tcp_pkts>9103</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="856"><ip.session_id>429</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4424479007720947</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40942531453132935</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40942531453132935</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="857"><ip.session_id>429</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.442452907562256</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4094244752493804</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4094244752493804</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>407</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>407</min_tcp_pkts><max_tcp_pkts>407</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="858"><ip.session_id>430</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.442476987838745</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.024080276489257812</time_between_pkts_sum><time_between_pkts_avg>0.024080276489257812</time_between_pkts_avg><time_between_pkts_max>0.024080276489257812</time_between_pkts_max><time_between_pkts_min>0.024080276489257812</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40942043875093453</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40942043875093453</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="859"><ip.session_id>430</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4424829483032227</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4094194396299444</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4094194396299444</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>161</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>161</min_tcp_pkts><max_tcp_pkts>161</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="860"><ip.session_id>431</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.442534923553467</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.051975250244140625</time_between_pkts_sum><time_between_pkts_avg>0.051975250244140625</time_between_pkts_avg><time_between_pkts_max>0.051975250244140625</time_between_pkts_max><time_between_pkts_min>0.051975250244140625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40941072750156327</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40941072750156327</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="861"><ip.session_id>431</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4425599575042725</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.025033950805664062</time_between_pkts_sum><time_between_pkts_avg>0.025033950805664062</time_between_pkts_avg><time_between_pkts_max>0.025033950805664062</time_between_pkts_max><time_between_pkts_min>0.025033950805664062</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40940653142523764</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40940653142523764</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1501</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1501</min_tcp_pkts><max_tcp_pkts>1501</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="862"><ip.session_id>432</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4435200691223145</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.9601116180419922</time_between_pkts_sum><time_between_pkts_avg>0.9601116180419922</time_between_pkts_avg><time_between_pkts_max>0.9601116180419922</time_between_pkts_max><time_between_pkts_min>0.9601116180419922</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40924566678889157</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40924566678889157</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="863"><ip.session_id>432</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4435291290283203</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.009059906005859375</time_between_pkts_sum><time_between_pkts_avg>0.009059906005859375</time_between_pkts_avg><time_between_pkts_max>0.009059906005859375</time_between_pkts_max><time_between_pkts_min>0.009059906005859375</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40924414942319687</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40924414942319687</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>49160</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>49160</min_tcp_pkts><max_tcp_pkts>49160</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="864"><ip.session_id>433</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4435760974884033</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.04696846008300781</time_between_pkts_sum><time_between_pkts_avg>0.04696846008300781</time_between_pkts_avg><time_between_pkts_max>0.04696846008300781</time_between_pkts_max><time_between_pkts_min>0.04696846008300781</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4092362832603562</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4092362832603562</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="865"><ip.session_id>433</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.443582057952881</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40923528503796325</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40923528503796325</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>27715</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>27715</min_tcp_pkts><max_tcp_pkts>27715</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="866"><ip.session_id>434</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.443634033203125</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.051975250244140625</time_between_pkts_sum><time_between_pkts_avg>0.051975250244140625</time_between_pkts_avg><time_between_pkts_max>0.051975250244140625</time_between_pkts_max><time_between_pkts_min>0.051975250244140625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4092265807450701</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4092265807450701</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="867"><ip.session_id>434</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4436399936676025</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4092255825700099</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4092255825700099</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>541</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>541</min_tcp_pkts><max_tcp_pkts>541</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="868"><ip.session_id>435</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.443695068359375</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.05507469177246094</time_between_pkts_sum><time_between_pkts_avg>0.05507469177246094</time_between_pkts_avg><time_between_pkts_max>0.05507469177246094</time_between_pkts_max><time_between_pkts_min>0.05507469177246094</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4092163596628161</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4092163596628161</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="869"><ip.session_id>435</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4437029361724854</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.007867813110351562</time_between_pkts_sum><time_between_pkts_avg>0.007867813110351562</time_between_pkts_avg><time_between_pkts_max>0.007867813110351562</time_between_pkts_max><time_between_pkts_min>0.007867813110351562</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40921504213858195</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40921504213858195</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1137</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1137</min_tcp_pkts><max_tcp_pkts>1137</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="870"><ip.session_id>436</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.443695068359375</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4092163596628161</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4092163596628161</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="871"><ip.session_id>436</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.443708896636963</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4092140440198102</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4092140440198102</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>8045</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>8045</min_tcp_pkts><max_tcp_pkts>8045</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="872"><ip.session_id>437</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4437129497528076</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0040531158447265625</time_between_pkts_sum><time_between_pkts_avg>0.0040531158447265625</time_between_pkts_avg><time_between_pkts_max>0.0040531158447265625</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40921336530182667</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40921336530182667</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="873"><ip.session_id>437</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4437179565429688</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4092125268886024</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4092125268886024</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>714</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>714</min_tcp_pkts><max_tcp_pkts>714</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="874"><ip.session_id>438</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.443743944168091</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.025987625122070312</time_between_pkts_sum><time_between_pkts_avg>0.025987625122070312</time_between_pkts_avg><time_between_pkts_max>0.025987625122070312</time_between_pkts_max><time_between_pkts_min>0.025987625122070312</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40920817517991803</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40920817517991803</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="875"><ip.session_id>438</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.443751096725464</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.007152557373046875</time_between_pkts_sum><time_between_pkts_avg>0.007152557373046875</time_between_pkts_avg><time_between_pkts_max>0.007152557373046875</time_between_pkts_max><time_between_pkts_min>0.007152557373046875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.409206977478174</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.409206977478174</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>4446</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>4446</min_tcp_pkts><max_tcp_pkts>4446</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="876"><ip.session_id>439</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.443743944168091</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40920817517991803</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40920817517991803</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="877"><ip.session_id>439</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.443758010864258</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40920581970648584</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40920581970648584</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>64680</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>64680</min_tcp_pkts><max_tcp_pkts>64680</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="878"><ip.session_id>440</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.443814992904663</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.05698204040527344</time_between_pkts_sum><time_between_pkts_avg>0.05698204040527344</time_between_pkts_avg><time_between_pkts_max>0.05698204040527344</time_between_pkts_max><time_between_pkts_min>0.05698204040527344</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4091962783203252</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4091962783203252</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="879"><ip.session_id>440</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.443821907043457</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4091951206091785</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4091951206091785</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>8652</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>8652</min_tcp_pkts><max_tcp_pkts>8652</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="880"><ip.session_id>441</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4438259601593018</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0040531158447265625</time_between_pkts_sum><time_between_pkts_avg>0.0040531158447265625</time_between_pkts_avg><time_between_pkts_max>0.0040531158447265625</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40919444195396576</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40919444195396576</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="881"><ip.session_id>441</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.443830966949463</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40919360361828144</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40919360361828144</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>2602</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>2602</min_tcp_pkts><max_tcp_pkts>2602</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="882"><ip.session_id>442</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.444027900695801</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.19693374633789062</time_between_pkts_sum><time_between_pkts_avg>0.19693374633789062</time_between_pkts_avg><time_between_pkts_max>0.19693374633789062</time_between_pkts_max><time_between_pkts_min>0.19693374633789062</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40916063180592405</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40916063180592405</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="883"><ip.session_id>442</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.444035053253174</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.007152557373046875</time_between_pkts_sum><time_between_pkts_avg>0.007152557373046875</time_between_pkts_avg><time_between_pkts_max>0.007152557373046875</time_between_pkts_max><time_between_pkts_min>0.007152557373046875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4091594343824706</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4091594343824706</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>8001</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>8001</min_tcp_pkts><max_tcp_pkts>8001</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="884"><ip.session_id>443</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4441919326782227</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.15687942504882812</time_between_pkts_sum><time_between_pkts_avg>0.15687942504882812</time_between_pkts_avg><time_between_pkts_max>0.15687942504882812</time_between_pkts_max><time_between_pkts_min>0.15687942504882812</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4091331726572922</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4091331726572922</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="885"><ip.session_id>443</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.444200038909912</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.008106231689453125</time_between_pkts_sum><time_between_pkts_avg>0.008106231689453125</time_between_pkts_avg><time_between_pkts_max>0.008106231689453125</time_between_pkts_max><time_between_pkts_min>0.008106231689453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40913181576005114</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40913181576005114</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>179</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>179</min_tcp_pkts><max_tcp_pkts>179</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="886"><ip.session_id>444</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4441919326782227</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4091331726572922</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4091331726572922</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="887"><ip.session_id>444</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4442050457000732</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40913097768095735</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40913097768095735</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1067</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1067</min_tcp_pkts><max_tcp_pkts>1067</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="888"><ip.session_id>445</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4442100524902344</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40913013960529704</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40913013960529704</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="889"><ip.session_id>445</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4442169666290283</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40912898226836314</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40912898226836314</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1092</min_tcp_pkts><max_tcp_pkts>1092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="890"><ip.session_id>446</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4442100524902344</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40913013960529704</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40913013960529704</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="891"><ip.session_id>446</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4442250728607178</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.008106231689453125</time_between_pkts_sum><time_between_pkts_avg>0.008106231689453125</time_between_pkts_avg><time_between_pkts_max>0.008106231689453125</time_between_pkts_max><time_between_pkts_min>0.008106231689453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40912762539891684</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40912762539891684</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>119</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>119</min_tcp_pkts><max_tcp_pkts>119</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="892"><ip.session_id>447</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.444227933883667</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.00286102294921875</time_between_pkts_sum><time_between_pkts_avg>0.00286102294921875</time_between_pkts_avg><time_between_pkts_max>0.00286102294921875</time_between_pkts_max><time_between_pkts_min>0.00286102294921875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.409127146505967</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.409127146505967</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="893"><ip.session_id>447</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4442338943481445</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4091261488159222</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4091261488159222</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>8800</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>8800</min_tcp_pkts><max_tcp_pkts>8800</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="894"><ip.session_id>448</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4442389011383057</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40912531076004494</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40912531076004494</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="895"><ip.session_id>448</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4442451000213623</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.006198883056640625</time_between_pkts_sum><time_between_pkts_avg>0.006198883056640625</time_between_pkts_avg><time_between_pkts_max>0.006198883056640625</time_between_pkts_max><time_between_pkts_min>0.006198883056640625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4091242731718109</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4091242731718109</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>902</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>902</min_tcp_pkts><max_tcp_pkts>902</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="896"><ip.session_id>449</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4442389011383057</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40912531076004494</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40912531076004494</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="897"><ip.session_id>449</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4442501068115234</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4091234351236177</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4091234351236177</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>38292</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>38292</min_tcp_pkts><max_tcp_pkts>38292</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="898"><ip.session_id>450</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4443130493164062</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0629425048828125</time_between_pkts_sum><time_between_pkts_avg>0.0629425048828125</time_between_pkts_avg><time_between_pkts_max>0.0629425048828125</time_between_pkts_max><time_between_pkts_min>0.0629425048828125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40911289995349287</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40911289995349287</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="899"><ip.session_id>450</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4443199634552</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40911174271409095</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40911174271409095</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>12174</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>12174</min_tcp_pkts><max_tcp_pkts>12174</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="900"><ip.session_id>451</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.444329023361206</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.009059906005859375</time_between_pkts_sum><time_between_pkts_avg>0.009059906005859375</time_between_pkts_avg><time_between_pkts_max>0.009059906005859375</time_between_pkts_max><time_between_pkts_min>0.009059906005859375</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4091102263413361</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4091102263413361</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="901"><ip.session_id>451</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4443349838256836</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4091092287338119</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4091092287338119</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>25735</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>25735</min_tcp_pkts><max_tcp_pkts>25735</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="902"><ip.session_id>452</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.444329023361206</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4091102263413361</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4091102263413361</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="903"><ip.session_id>452</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4443418979644775</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4091080715151791</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4091080715151791</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>7512</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>7512</min_tcp_pkts><max_tcp_pkts>7512</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="904"><ip.session_id>453</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4443769454956055</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.03504753112792969</time_between_pkts_sum><time_between_pkts_avg>0.03504753112792969</time_between_pkts_avg><time_between_pkts_max>0.03504753112792969</time_between_pkts_max><time_between_pkts_min>0.03504753112792969</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40910220571453093</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40910220571453093</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="905"><ip.session_id>453</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.444385051727295</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.008106231689453125</time_between_pkts_sum><time_between_pkts_avg>0.008106231689453125</time_between_pkts_avg><time_between_pkts_max>0.008106231689453125</time_between_pkts_max><time_between_pkts_min>0.008106231689453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40910084902268656</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40910084902268656</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>2121</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>2121</min_tcp_pkts><max_tcp_pkts>2121</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="906"><ip.session_id>454</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4443769454956055</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40910220571453093</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40910220571453093</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="907"><ip.session_id>454</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.444391965866089</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4090996918514594</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4090996918514594</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>13782</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>13782</min_tcp_pkts><max_tcp_pkts>13782</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="908"><ip.session_id>455</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4443960189819336</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0040531158447265625</time_between_pkts_sum><time_between_pkts_avg>0.0040531158447265625</time_between_pkts_avg><time_between_pkts_max>0.0040531158447265625</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.409099013512749</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.409099013512749</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="909"><ip.session_id>455</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.444406032562256</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.010013580322265625</time_between_pkts_sum><time_between_pkts_avg>0.010013580322265625</time_between_pkts_avg><time_between_pkts_max>0.010013580322265625</time_between_pkts_max><time_between_pkts_min>0.010013580322265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4090973376267559</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4090973376267559</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>26</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>26</min_tcp_pkts><max_tcp_pkts>26</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="910"><ip.session_id>456</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4443960189819336</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.409099013512749</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.409099013512749</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="911"><ip.session_id>456</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4444119930267334</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4090963400820884</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4090963400820884</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>8086</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>8086</min_tcp_pkts><max_tcp_pkts>8086</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="912"><ip.session_id>457</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4443960189819336</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.409099013512749</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.409099013512749</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="913"><ip.session_id>457</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4444169998168945</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40909550214832724</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40909550214832724</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>366</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>366</min_tcp_pkts><max_tcp_pkts>366</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="914"><ip.session_id>458</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.444566011428833</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.14901161193847656</time_between_pkts_sum><time_between_pkts_avg>0.14901161193847656</time_between_pkts_avg><time_between_pkts_max>0.14901161193847656</time_between_pkts_max><time_between_pkts_min>0.14901161193847656</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4090705652147665</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4090705652147665</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="915"><ip.session_id>458</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4445719718933105</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4090695678006585</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4090695678006585</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>497</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>497</min_tcp_pkts><max_tcp_pkts>497</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="916"><ip.session_id>459</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4446139335632324</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.041961669921875</time_between_pkts_sum><time_between_pkts_avg>0.041961669921875</time_between_pkts_avg><time_between_pkts_max>0.041961669921875</time_between_pkts_max><time_between_pkts_min>0.041961669921875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40906254614298754</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40906254614298754</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="917"><ip.session_id>459</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.444622039794922</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.008106231689453125</time_between_pkts_sum><time_between_pkts_avg>0.008106231689453125</time_between_pkts_avg><time_between_pkts_max>0.008106231689453125</time_between_pkts_max><time_between_pkts_min>0.008106231689453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4090611897141734</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4090611897141734</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1782</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1782</min_tcp_pkts><max_tcp_pkts>1782</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="918"><ip.session_id>460</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4446139335632324</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40906254614298754</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40906254614298754</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="919"><ip.session_id>460</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.444627046585083</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4090603519243997</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4090603519243997</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>3827</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>3827</min_tcp_pkts><max_tcp_pkts>3827</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="920"><ip.session_id>461</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4751410484313965</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>30.514001846313477</time_between_pkts_sum><time_between_pkts_avg>30.514001846313477</time_between_pkts_avg><time_between_pkts_max>30.514001846313477</time_between_pkts_max><time_between_pkts_min>30.514001846313477</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4040173793868204</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4040173793868204</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="921"><ip.session_id>461</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4751651287078857</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.024080276489257812</time_between_pkts_sum><time_between_pkts_avg>0.024080276489257812</time_between_pkts_avg><time_between_pkts_max>0.024080276489257812</time_between_pkts_max><time_between_pkts_min>0.024080276489257812</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40401344880049744</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40401344880049744</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1</min_tcp_pkts><max_tcp_pkts>1</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="922"><ip.session_id>462</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4751739501953125</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.008821487426757812</time_between_pkts_sum><time_between_pkts_avg>0.008821487426757812</time_between_pkts_avg><time_between_pkts_max>0.008821487426757812</time_between_pkts_max><time_between_pkts_min>0.008821487426757812</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40401200890187594</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40401200890187594</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="923"><ip.session_id>462</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4751830101013184</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.009059906005859375</time_between_pkts_sum><time_between_pkts_avg>0.009059906005859375</time_between_pkts_avg><time_between_pkts_max>0.009059906005859375</time_between_pkts_max><time_between_pkts_min>0.009059906005859375</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40401053009775884</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40401053009775884</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1034</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1034</min_tcp_pkts><max_tcp_pkts>1034</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="924"><ip.session_id>463</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4751739501953125</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40401200890187594</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40401200890187594</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="925"><ip.session_id>463</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4751880168914795</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4040097128685491</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4040097128685491</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>3889</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>3889</min_tcp_pkts><max_tcp_pkts>3889</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="926"><ip.session_id>464</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4751739501953125</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40401200890187594</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40401200890187594</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="927"><ip.session_id>464</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.475191116333008</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0030994415283203125</time_between_pkts_sum><time_between_pkts_avg>0.0030994415283203125</time_between_pkts_avg><time_between_pkts_max>0.0030994415283203125</time_between_pkts_max><time_between_pkts_min>0.0030994415283203125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40400920696640935</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40400920696640935</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>898</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>898</min_tcp_pkts><max_tcp_pkts>898</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="928"><ip.session_id>465</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.475198984146118</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.007867813110351562</time_between_pkts_sum><time_between_pkts_avg>0.007867813110351562</time_between_pkts_avg><time_between_pkts_max>0.007867813110351562</time_between_pkts_max><time_between_pkts_min>0.007867813110351562</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4040079227589757</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4040079227589757</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="929"><ip.session_id>465</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4752039909362793</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4040071055403141</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4040071055403141</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>5431</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>5431</min_tcp_pkts><max_tcp_pkts>5431</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="930"><ip.session_id>466</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4752750396728516</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.07104873657226562</time_between_pkts_sum><time_between_pkts_avg>0.07104873657226562</time_between_pkts_avg><time_between_pkts_max>0.07104873657226562</time_between_pkts_max><time_between_pkts_min>0.07104873657226562</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.403995509174676</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.403995509174676</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="931"><ip.session_id>466</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4752819538116455</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4039943807048392</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4039943807048392</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>9091</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>9091</min_tcp_pkts><max_tcp_pkts>9091</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="932"><ip.session_id>467</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4752869606018066</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4039935635409617</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4039935635409617</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="933"><ip.session_id>467</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4752919673919678</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40399274638039007</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40399274638039007</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1010</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1010</min_tcp_pkts><max_tcp_pkts>1010</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="934"><ip.session_id>468</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4753289222717285</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.03695487976074219</time_between_pkts_sum><time_between_pkts_avg>0.03695487976074219</time_between_pkts_avg><time_between_pkts_max>0.03695487976074219</time_between_pkts_max><time_between_pkts_min>0.03695487976074219</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4039867150593675</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4039867150593675</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="935"><ip.session_id>468</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.475342035293579</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.013113021850585938</time_between_pkts_sum><time_between_pkts_avg>0.013113021850585938</time_between_pkts_avg><time_between_pkts_max>0.013113021850585938</time_between_pkts_max><time_between_pkts_min>0.013113021850585938</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4039845749564862</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4039845749564862</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1999</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1999</min_tcp_pkts><max_tcp_pkts>1999</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="936"><ip.session_id>469</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4753289222717285</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4039867150593675</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4039867150593675</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="937"><ip.session_id>469</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4753499031066895</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.007867813110351562</time_between_pkts_sum><time_between_pkts_avg>0.007867813110351562</time_between_pkts_avg><time_between_pkts_max>0.007867813110351562</time_between_pkts_max><time_between_pkts_min>0.007867813110351562</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.403983290905641</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.403983290905641</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>5907</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>5907</min_tcp_pkts><max_tcp_pkts>5907</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="938"><ip.session_id>470</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4753289222717285</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4039867150593675</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4039867150593675</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="939"><ip.session_id>470</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4753549098968506</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40398247378662583</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40398247378662583</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>458</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>458</min_tcp_pkts><max_tcp_pkts>458</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="940"><ip.session_id>471</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4753611087799072</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.006198883056640625</time_between_pkts_sum><time_between_pkts_avg>0.006198883056640625</time_between_pkts_avg><time_between_pkts_max>0.006198883056640625</time_between_pkts_max><time_between_pkts_min>0.006198883056640625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40398146212004393</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40398146212004393</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="941"><ip.session_id>471</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4753711223602295</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.010013580322265625</time_between_pkts_sum><time_between_pkts_avg>0.010013580322265625</time_between_pkts_avg><time_between_pkts_max>0.010013580322265625</time_between_pkts_max><time_between_pkts_min>0.010013580322265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.403979827900115</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.403979827900115</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>7625</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>7625</min_tcp_pkts><max_tcp_pkts>7625</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="942"><ip.session_id>472</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4753611087799072</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40398146212004393</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40398146212004393</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="943"><ip.session_id>472</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.475377082824707</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4039788551564346</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4039788551564346</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>668</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>668</min_tcp_pkts><max_tcp_pkts>668</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="944"><ip.session_id>473</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4753611087799072</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40398146212004393</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40398146212004393</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="945"><ip.session_id>473</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.475382089614868</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4039780380553633</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4039780380553633</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1041</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1041</min_tcp_pkts><max_tcp_pkts>1041</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="946"><ip.session_id>474</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4753611087799072</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40398146212004393</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40398146212004393</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="947"><ip.session_id>474</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4753849506378174</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.00286102294921875</time_between_pkts_sum><time_between_pkts_avg>0.00286102294921875</time_between_pkts_avg><time_between_pkts_max>0.00286102294921875</time_between_pkts_max><time_between_pkts_min>0.00286102294921875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4039775711419495</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4039775711419495</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>2382</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>2382</min_tcp_pkts><max_tcp_pkts>2382</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="948"><ip.session_id>475</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4754230976104736</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.03814697265625</time_between_pkts_sum><time_between_pkts_avg>0.03814697265625</time_between_pkts_avg><time_between_pkts_max>0.03814697265625</time_between_pkts_max><time_between_pkts_min>0.03814697265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4039713457328972</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4039713457328972</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="949"><ip.session_id>475</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4754300117492676</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40397021739804634</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40397021739804634</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>2288</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>2288</min_tcp_pkts><max_tcp_pkts>2288</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="950"><ip.session_id>476</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4754340648651123</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0040531158447265625</time_between_pkts_sum><time_between_pkts_avg>0.0040531158447265625</time_between_pkts_avg><time_between_pkts_max>0.0040531158447265625</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4039695559633056</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4039695559633056</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="951"><ip.session_id>476</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4754390716552734</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4039687388998515</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4039687388998515</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>8009</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>8009</min_tcp_pkts><max_tcp_pkts>8009</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="952"><ip.session_id>477</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.476583957672119</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>1.1448860168457031</time_between_pkts_sum><time_between_pkts_avg>1.1448860168457031</time_between_pkts_avg><time_between_pkts_max>1.1448860168457031</time_between_pkts_max><time_between_pkts_min>1.1448860168457031</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4037819904720518</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4037819904720518</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="953"><ip.session_id>477</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.476591110229492</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.007152557373046875</time_between_pkts_sum><time_between_pkts_avg>0.007152557373046875</time_between_pkts_avg><time_between_pkts_max>0.007152557373046875</time_between_pkts_max><time_between_pkts_min>0.007152557373046875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4037808243232107</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4037808243232107</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>808</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>808</min_tcp_pkts><max_tcp_pkts>808</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="954"><ip.session_id>478</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4766669273376465</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.07581710815429688</time_between_pkts_sum><time_between_pkts_avg>0.07581710815429688</time_between_pkts_avg><time_between_pkts_max>0.07581710815429688</time_between_pkts_max><time_between_pkts_min>0.07581710815429688</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4037684635596012</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4037684635596012</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="955"><ip.session_id>478</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.476673126220703</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.006198883056640625</time_between_pkts_sum><time_between_pkts_avg>0.006198883056640625</time_between_pkts_avg><time_between_pkts_max>0.006198883056640625</time_between_pkts_max><time_between_pkts_min>0.006198883056640625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4037674529645973</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4037674529645973</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>6779</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>6779</min_tcp_pkts><max_tcp_pkts>6779</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="956"><ip.session_id>479</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.476694107055664</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0209808349609375</time_between_pkts_sum><time_between_pkts_avg>0.0209808349609375</time_between_pkts_avg><time_between_pkts_max>0.0209808349609375</time_between_pkts_max><time_between_pkts_min>0.0209808349609375</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4037640325267366</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4037640325267366</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="957"><ip.session_id>479</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4767041206359863</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.010013580322265625</time_between_pkts_sum><time_between_pkts_avg>0.010013580322265625</time_between_pkts_avg><time_between_pkts_max>0.010013580322265625</time_between_pkts_max><time_between_pkts_min>0.010013580322265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4037624000654598</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4037624000654598</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1078</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1078</min_tcp_pkts><max_tcp_pkts>1078</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="958"><ip.session_id>480</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.476694107055664</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4037640325267366</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4037640325267366</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="959"><ip.session_id>480</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4767110347747803</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40376127289752034</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40376127289752034</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>30</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>30</min_tcp_pkts><max_tcp_pkts>30</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="960"><ip.session_id>481</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.476694107055664</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4037640325267366</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4037640325267366</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="961"><ip.session_id>481</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.476716995239258</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40376030120607187</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40376030120607187</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>548</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>548</min_tcp_pkts><max_tcp_pkts>548</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="962"><ip.session_id>482</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.476720094680786</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0030994415283203125</time_between_pkts_sum><time_between_pkts_avg>0.0030994415283203125</time_between_pkts_avg><time_between_pkts_max>0.0030994415283203125</time_between_pkts_max><time_between_pkts_min>0.0030994415283203125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40375979592836697</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40375979592836697</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="963"><ip.session_id>482</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4767260551452637</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4037588242440275</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4037588242440275</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>5414</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>5414</min_tcp_pkts><max_tcp_pkts>5414</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="964"><ip.session_id>483</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.476720094680786</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40375979592836697</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40375979592836697</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="965"><ip.session_id>483</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.476731061935425</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40375800803279654</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40375800803279654</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>6669</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>6669</min_tcp_pkts><max_tcp_pkts>6669</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="966"><ip.session_id>484</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.476757049560547</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.025987625122070312</time_between_pkts_sum><time_between_pkts_avg>0.025987625122070312</time_between_pkts_avg><time_between_pkts_max>0.025987625122070312</time_between_pkts_max><time_between_pkts_min>0.025987625122070312</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40375377156085246</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40375377156085246</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="967"><ip.session_id>484</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.476763963699341</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4037526444410881</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4037526444410881</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>4111</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>4111</min_tcp_pkts><max_tcp_pkts>4111</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="968"><ip.session_id>485</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4768030643463135</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.03910064697265625</time_between_pkts_sum><time_between_pkts_avg>0.03910064697265625</time_between_pkts_avg><time_between_pkts_max>0.03910064697265625</time_between_pkts_max><time_between_pkts_min>0.03910064697265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40374627050290873</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40374627050290873</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="969"><ip.session_id>485</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.476809024810791</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4037452988836684</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4037452988836684</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>51103</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>51103</min_tcp_pkts><max_tcp_pkts>51103</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="970"><ip.session_id>486</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.476836919784546</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.027894973754882812</time_between_pkts_sum><time_between_pkts_avg>0.027894973754882812</time_between_pkts_avg><time_between_pkts_max>0.027894973754882812</time_between_pkts_max><time_between_pkts_min>0.027894973754882812</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4037407517677779</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4037407517677779</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="971"><ip.session_id>486</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.476846933364868</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.008821487426757812</time_between_pkts_sum><time_between_pkts_avg>0.008821487426757812</time_between_pkts_avg><time_between_pkts_max>0.008821487426757812</time_between_pkts_max><time_between_pkts_min>0.008821487426757812</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40373911949474856</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40373911949474856</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>10566</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>10566</min_tcp_pkts><max_tcp_pkts>10566</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="972"><ip.session_id>487</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4768381118774414</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0011920928955078125</time_between_pkts_sum><time_between_pkts_avg>0.0011920928955078125</time_between_pkts_avg><time_between_pkts_max>0.0011920928955078125</time_between_pkts_max><time_between_pkts_min>0.0011920928955078125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40374055744886805</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40374055744886805</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="973"><ip.session_id>487</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4768550395965576</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.008106231689453125</time_between_pkts_sum><time_between_pkts_avg>0.008106231689453125</time_between_pkts_avg><time_between_pkts_max>0.008106231689453125</time_between_pkts_max><time_between_pkts_min>0.008106231689453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4037377981405343</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4037377981405343</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>49153</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>49153</min_tcp_pkts><max_tcp_pkts>49153</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="974"><ip.session_id>488</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4768381118774414</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40374055744886805</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40374055744886805</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="975"><ip.session_id>488</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4768590927124023</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0040531158447265625</time_between_pkts_sum><time_between_pkts_avg>0.0040531158447265625</time_between_pkts_avg><time_between_pkts_max>0.0040531158447265625</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4037371374666705</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4037371374666705</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>8010</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>8010</min_tcp_pkts><max_tcp_pkts>8010</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="976"><ip.session_id>489</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4768619537353516</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.00286102294921875</time_between_pkts_sum><time_between_pkts_avg>0.00286102294921875</time_between_pkts_avg><time_between_pkts_max>0.00286102294921875</time_between_pkts_max><time_between_pkts_min>0.00286102294921875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4037366711099509</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4037366711099509</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="977"><ip.session_id>489</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4768660068511963</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0040531158447265625</time_between_pkts_sum><time_between_pkts_avg>0.0040531158447265625</time_between_pkts_avg><time_between_pkts_max>0.0040531158447265625</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40373601043977564</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40373601043977564</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1065</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1065</min_tcp_pkts><max_tcp_pkts>1065</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="978"><ip.session_id>490</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4769439697265625</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.07796287536621094</time_between_pkts_sum><time_between_pkts_avg>0.07796287536621094</time_between_pkts_avg><time_between_pkts_max>0.07796287536621094</time_between_pkts_max><time_between_pkts_min>0.07796287536621094</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4037233026754308</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4037233026754308</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="979"><ip.session_id>490</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4769630432128906</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.019073486328125</time_between_pkts_sum><time_between_pkts_avg>0.019073486328125</time_between_pkts_avg><time_between_pkts_max>0.019073486328125</time_between_pkts_max><time_between_pkts_min>0.019073486328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40372019386405184</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40372019386405184</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>7435</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>7435</min_tcp_pkts><max_tcp_pkts>7435</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="980"><ip.session_id>491</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4769439697265625</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4037233026754308</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4037233026754308</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="981"><ip.session_id>491</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.476969003677368</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4037192223703146</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4037192223703146</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1147</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1147</min_tcp_pkts><max_tcp_pkts>1147</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="982"><ip.session_id>492</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4769439697265625</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4037233026754308</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4037233026754308</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="983"><ip.session_id>492</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4769740104675293</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40371840631918854</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40371840631918854</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>19801</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>19801</min_tcp_pkts><max_tcp_pkts>19801</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="984"><ip.session_id>493</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4769439697265625</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4037233026754308</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4037233026754308</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="985"><ip.session_id>493</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4769771099090576</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0030994415283203125</time_between_pkts_sum><time_between_pkts_avg>0.0030994415283203125</time_between_pkts_avg><time_between_pkts_max>0.0030994415283203125</time_between_pkts_max><time_between_pkts_min>0.0030994415283203125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4037179011463352</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4037179011463352</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>2179</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>2179</min_tcp_pkts><max_tcp_pkts>2179</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="986"><ip.session_id>494</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4769821166992188</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40371708510055043</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40371708510055043</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="987"><ip.session_id>494</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4769949913024902</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.012874603271484375</time_between_pkts_sum><time_between_pkts_avg>0.012874603271484375</time_between_pkts_avg><time_between_pkts_max>0.012874603271484375</time_between_pkts_max><time_between_pkts_min>0.012874603271484375</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40371498671225214</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40371498671225214</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1583</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1583</min_tcp_pkts><max_tcp_pkts>1583</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="988"><ip.session_id>495</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4769821166992188</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40371708510055043</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40371708510055043</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="989"><ip.session_id>495</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.476999044418335</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0040531158447265625</time_between_pkts_sum><time_between_pkts_avg>0.0040531158447265625</time_between_pkts_avg><time_between_pkts_max>0.0040531158447265625</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4037143261130432</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4037143261130432</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1049</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1049</min_tcp_pkts><max_tcp_pkts>1049</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="990"><ip.session_id>496</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4769821166992188</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40371708510055043</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40371708510055043</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="991"><ip.session_id>496</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4770050048828125</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4037133546475455</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4037133546475455</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>9595</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>9595</min_tcp_pkts><max_tcp_pkts>9595</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="992"><ip.session_id>497</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4769821166992188</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40371708510055043</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40371708510055043</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="993"><ip.session_id>497</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.477008104324341</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0030994415283203125</time_between_pkts_sum><time_between_pkts_avg>0.0030994415283203125</time_between_pkts_avg><time_between_pkts_max>0.0030994415283203125</time_between_pkts_max><time_between_pkts_min>0.0030994415283203125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4037128494873344</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4037128494873344</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>9535</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>9535</min_tcp_pkts><max_tcp_pkts>9535</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="994"><ip.session_id>498</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4769821166992188</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40371708510055043</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40371708510055043</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="995"><ip.session_id>498</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.477013111114502</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40371203346197154</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40371203346197154</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>49999</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>49999</min_tcp_pkts><max_tcp_pkts>49999</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="996"><ip.session_id>499</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4769821166992188</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40371708510055043</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40371708510055043</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="997"><ip.session_id>499</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4770150184631348</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0019073486328125</time_between_pkts_sum><time_between_pkts_avg>0.0019073486328125</time_between_pkts_avg><time_between_pkts_max>0.0019073486328125</time_between_pkts_max><time_between_pkts_min>0.0019073486328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4037117225960344</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4037117225960344</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>49165</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>49165</min_tcp_pkts><max_tcp_pkts>49165</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="998"><ip.session_id>500</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4770610332489014</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.04601478576660156</time_between_pkts_sum><time_between_pkts_avg>0.04601478576660156</time_between_pkts_avg><time_between_pkts_max>0.04601478576660156</time_between_pkts_max><time_between_pkts_min>0.04601478576660156</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40370422310039117</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40370422310039117</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="999"><ip.session_id>500</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.477066993713379</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40370325168351495</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40370325168351495</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1071</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1071</min_tcp_pkts><max_tcp_pkts>1071</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1000"><ip.session_id>501</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.47707200050354</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40370243569695174</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40370243569695174</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1001"><ip.session_id>501</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.477077007293701</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4037016197136872</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4037016197136872</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>3920</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>3920</min_tcp_pkts><max_tcp_pkts>3920</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1002"><ip.session_id>502</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.477092981338501</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.015974044799804688</time_between_pkts_sum><time_between_pkts_avg>0.015974044799804688</time_between_pkts_avg><time_between_pkts_max>0.015974044799804688</time_between_pkts_max><time_between_pkts_min>0.015974044799804688</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40369901636056005</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40369901636056005</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1003"><ip.session_id>502</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.477102041244507</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.009059906005859375</time_between_pkts_sum><time_between_pkts_avg>0.009059906005859375</time_between_pkts_avg><time_between_pkts_max>0.009059906005859375</time_between_pkts_max><time_between_pkts_min>0.009059906005859375</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4036975398468428</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4036975398468428</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>5678</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>5678</min_tcp_pkts><max_tcp_pkts>5678</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1004"><ip.session_id>503</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.477092981338501</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40369901636056005</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40369901636056005</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1005"><ip.session_id>503</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.477108955383301</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4036964130410093</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4036964130410093</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>4045</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>4045</min_tcp_pkts><max_tcp_pkts>4045</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1006"><ip.session_id>504</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.477112054824829</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0030994415283203125</time_between_pkts_sum><time_between_pkts_avg>0.0030994415283203125</time_between_pkts_avg><time_between_pkts_max>0.0030994415283203125</time_between_pkts_max><time_between_pkts_min>0.0030994415283203125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40369590792319476</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40369590792319476</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1007"><ip.session_id>504</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.477116107940674</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0040531158447265625</time_between_pkts_sum><time_between_pkts_avg>0.0040531158447265625</time_between_pkts_avg><time_between_pkts_max>0.0040531158447265625</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40369524738642154</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40369524738642154</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>2607</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>2607</min_tcp_pkts><max_tcp_pkts>2607</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1008"><ip.session_id>505</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.477138042449951</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.02193450927734375</time_between_pkts_sum><time_between_pkts_avg>0.02193450927734375</time_between_pkts_avg><time_between_pkts_max>0.02193450927734375</time_between_pkts_max><time_between_pkts_min>0.02193450927734375</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40369167275432705</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40369167275432705</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1009"><ip.session_id>505</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.477144956588745</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4036905459812458</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4036905459812458</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>783</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>783</min_tcp_pkts><max_tcp_pkts>783</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1010"><ip.session_id>506</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4771389961242676</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.00095367431640625</time_between_pkts_sum><time_between_pkts_avg>0.00095367431640625</time_between_pkts_avg><time_between_pkts_max>0.00095367431640625</time_between_pkts_max><time_between_pkts_min>0.00095367431640625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4036915173369764</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4036915173369764</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1011"><ip.session_id>506</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4771530628204346</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.008106231689453125</time_between_pkts_sum><time_between_pkts_avg>0.008106231689453125</time_between_pkts_avg><time_between_pkts_max>0.008106231689453125</time_between_pkts_max><time_between_pkts_min>0.008106231689453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4036892249449539</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4036892249449539</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>57797</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>57797</min_tcp_pkts><max_tcp_pkts>57797</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1012"><ip.session_id>507</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4771549701690674</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0019073486328125</time_between_pkts_sum><time_between_pkts_avg>0.0019073486328125</time_between_pkts_avg><time_between_pkts_max>0.0019073486328125</time_between_pkts_max><time_between_pkts_min>0.0019073486328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40368891411414176</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40368891411414176</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1013"><ip.session_id>507</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.477159023284912</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0040531158447265625</time_between_pkts_sum><time_between_pkts_avg>0.0040531158447265625</time_between_pkts_avg><time_between_pkts_max>0.0040531158447265625</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4036882536002552</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4036882536002552</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>50800</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>50800</min_tcp_pkts><max_tcp_pkts>50800</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1014"><ip.session_id>508</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.477268934249878</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.10991096496582031</time_between_pkts_sum><time_between_pkts_avg>0.10991096496582031</time_between_pkts_avg><time_between_pkts_max>0.10991096496582031</time_between_pkts_max><time_between_pkts_min>0.10991096496582031</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40367034284180453</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40367034284180453</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1015"><ip.session_id>508</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4772748947143555</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4036693715879706</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4036693715879706</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1524</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1524</min_tcp_pkts><max_tcp_pkts>1524</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1016"><ip.session_id>509</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.477288007736206</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.013113021850585938</time_between_pkts_sum><time_between_pkts_avg>0.013113021850585938</time_between_pkts_avg><time_between_pkts_max>0.013113021850585938</time_between_pkts_max><time_between_pkts_min>0.013113021850585938</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40366723484598765</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40366723484598765</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1017"><ip.session_id>509</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.477294921875</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40366610820932297</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40366610820932297</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1972</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1972</min_tcp_pkts><max_tcp_pkts>1972</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1018"><ip.session_id>510</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.477288007736206</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40366723484598765</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40366723484598765</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1019"><ip.session_id>510</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.477302074432373</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.007152557373046875</time_between_pkts_sum><time_between_pkts_avg>0.007152557373046875</time_between_pkts_avg><time_between_pkts_max>0.007152557373046875</time_between_pkts_max><time_between_pkts_min>0.007152557373046875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40366494272973596</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40366494272973596</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>3580</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>3580</min_tcp_pkts><max_tcp_pkts>3580</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1020"><ip.session_id>511</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4773049354553223</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.00286102294921875</time_between_pkts_sum><time_between_pkts_avg>0.00286102294921875</time_between_pkts_avg><time_between_pkts_max>0.00286102294921875</time_between_pkts_max><time_between_pkts_min>0.00286102294921875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4036644765397856</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4036644765397856</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1021"><ip.session_id>511</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4773108959198</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.00476837158203125</time_between_pkts_sum><time_between_pkts_avg>0.00476837158203125</time_between_pkts_avg><time_between_pkts_max>0.00476837158203125</time_between_pkts_max><time_between_pkts_min>0.00476837158203125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40366350531418077</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40366350531418077</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1984</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1984</min_tcp_pkts><max_tcp_pkts>1984</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1022"><ip.session_id>512</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4773061275482178</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0011920928955078125</time_between_pkts_sum><time_between_pkts_avg>0.0011920928955078125</time_between_pkts_avg><time_between_pkts_max>0.0011920928955078125</time_between_pkts_max><time_between_pkts_min>0.0011920928955078125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40366428229429074</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40366428229429074</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1023"><ip.session_id>512</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.477315902709961</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40366268948828443</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40366268948828443</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>50002</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>50002</min_tcp_pkts><max_tcp_pkts>50002</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1024"><ip.session_id>513</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.477344036102295</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.028133392333984375</time_between_pkts_sum><time_between_pkts_avg>0.028133392333984375</time_between_pkts_avg><time_between_pkts_max>0.028133392333984375</time_between_pkts_max><time_between_pkts_min>0.028133392333984375</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40365810538504787</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40365810538504787</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1025"><ip.session_id>513</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.477349042892456</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40365728958097846</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40365728958097846</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>34572</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>34572</min_tcp_pkts><max_tcp_pkts>34572</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1026"><ip.session_id>514</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4781579971313477</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.8089542388916016</time_between_pkts_sum><time_between_pkts_avg>0.8089542388916016</time_between_pkts_avg><time_between_pkts_max>0.8089542388916016</time_between_pkts_max><time_between_pkts_min>0.8089542388916016</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40352552224578675</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40352552224578675</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1027"><ip.session_id>514</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.478163957595825</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4035245516887202</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4035245516887202</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>5510</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>5510</min_tcp_pkts><max_tcp_pkts>5510</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1028"><ip.session_id>515</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4781689643859863</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4035237364243923</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4035237364243923</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1029"><ip.session_id>515</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.478173017501831</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0040531158447265625</time_between_pkts_sum><time_between_pkts_avg>0.0040531158447265625</time_between_pkts_avg><time_between_pkts_max>0.0040531158447265625</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4035230764509206</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4035230764509206</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>900</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>900</min_tcp_pkts><max_tcp_pkts>900</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1030"><ip.session_id>516</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4782309532165527</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.05793571472167969</time_between_pkts_sum><time_between_pkts_avg>0.05793571472167969</time_between_pkts_avg><time_between_pkts_max>0.05793571472167969</time_between_pkts_max><time_between_pkts_min>0.05793571472167969</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40351364294844155</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40351364294844155</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1031"><ip.session_id>516</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4782369136810303</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40351267244851813</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40351267244851813</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>3001</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>3001</min_tcp_pkts><max_tcp_pkts>3001</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1032"><ip.session_id>517</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.478361129760742</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.12421607971191406</time_between_pkts_sum><time_between_pkts_avg>0.12421607971191406</time_between_pkts_avg><time_between_pkts_max>0.12421607971191406</time_between_pkts_max><time_between_pkts_min>0.12421607971191406</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4034924482924483</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4034924482924483</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1033"><ip.session_id>517</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.478365898132324</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.00476837158203125</time_between_pkts_sum><time_between_pkts_avg>0.00476837158203125</time_between_pkts_avg><time_between_pkts_max>0.00476837158203125</time_between_pkts_max><time_between_pkts_min>0.00476837158203125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4034916719736951</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4034916719736951</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>481</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>481</min_tcp_pkts><max_tcp_pkts>481</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1034"><ip.session_id>518</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4784250259399414</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0591278076171875</time_between_pkts_sum><time_between_pkts_avg>0.0591278076171875</time_between_pkts_avg><time_between_pkts_max>0.0591278076171875</time_between_pkts_max><time_between_pkts_min>0.0591278076171875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40348204586933206</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40348204586933206</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1035"><ip.session_id>518</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4784300327301025</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40348123077674897</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40348123077674897</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1328</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1328</min_tcp_pkts><max_tcp_pkts>1328</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1036"><ip.session_id>519</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4784820079803467</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.051975250244140625</time_between_pkts_sum><time_between_pkts_avg>0.051975250244140625</time_between_pkts_avg><time_between_pkts_max>0.051975250244140625</time_between_pkts_max><time_between_pkts_min>0.051975250244140625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40347276953399197</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40347276953399197</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1037"><ip.session_id>519</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4784889221191406</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40347164398257096</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40347164398257096</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>8443</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>8443</min_tcp_pkts><max_tcp_pkts>8443</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1038"><ip.session_id>520</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4784929752349854</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0040531158447265625</time_between_pkts_sum><time_between_pkts_avg>0.0040531158447265625</time_between_pkts_avg><time_between_pkts_max>0.0040531158447265625</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4034709841794852</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4034709841794852</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1039"><ip.session_id>520</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.47849702835083</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0040531158447265625</time_between_pkts_sum><time_between_pkts_avg>0.0040531158447265625</time_between_pkts_avg><time_between_pkts_max>0.0040531158447265625</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4034703243785574</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4034703243785574</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>2041</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>2041</min_tcp_pkts><max_tcp_pkts>2041</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1040"><ip.session_id>521</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4785211086273193</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.024080276489257812</time_between_pkts_sum><time_between_pkts_avg>0.024080276489257812</time_between_pkts_avg><time_between_pkts_max>0.024080276489257812</time_between_pkts_max><time_between_pkts_min>0.024080276489257812</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40346640442930526</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40346640442930526</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1041"><ip.session_id>521</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.478527069091797</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40346543415659714</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40346543415659714</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>32</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>32</min_tcp_pkts><max_tcp_pkts>32</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1042"><ip.session_id>522</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4785211086273193</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40346640442930526</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40346640442930526</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1043"><ip.session_id>522</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.478533983230591</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4034643086461021</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4034643086461021</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>3828</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>3828</min_tcp_pkts><max_tcp_pkts>3828</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1044"><ip.session_id>523</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4785521030426025</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.01811981201171875</time_between_pkts_sum><time_between_pkts_avg>0.01811981201171875</time_between_pkts_avg><time_between_pkts_max>0.01811981201171875</time_between_pkts_max><time_between_pkts_min>0.01811981201171875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4034613590621829</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4034613590621829</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1045"><ip.session_id>523</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.47855806350708</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4034603888137412</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4034603888137412</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>16018</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>16018</min_tcp_pkts><max_tcp_pkts>16018</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1046"><ip.session_id>524</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4785521030426025</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4034613590621829</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4034613590621829</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1047"><ip.session_id>524</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4785640239715576</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40345941856996603</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40345941856996603</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>15002</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>15002</min_tcp_pkts><max_tcp_pkts>15002</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1048"><ip.session_id>525</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.478717088699341</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.15306472778320312</time_between_pkts_sum><time_between_pkts_avg>0.15306472778320312</time_between_pkts_avg><time_between_pkts_max>0.15306472778320312</time_between_pkts_max><time_between_pkts_min>0.15306472778320312</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40343450430832783</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40343450430832783</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1049"><ip.session_id>525</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.478722095489502</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.403433689407815</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.403433689407815</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>8011</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>8011</min_tcp_pkts><max_tcp_pkts>8011</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1050"><ip.session_id>526</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4787590503692627</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.03695487976074219</time_between_pkts_sum><time_between_pkts_avg>0.03695487976074219</time_between_pkts_avg><time_between_pkts_max>0.03695487976074219</time_between_pkts_max><time_between_pkts_min>0.03695487976074219</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40342767476775493</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40342767476775493</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1051"><ip.session_id>526</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4787659645080566</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4034265494679176</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4034265494679176</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1721</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1721</min_tcp_pkts><max_tcp_pkts>1721</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1052"><ip.session_id>527</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4787709712982178</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4034257345995405</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4034257345995405</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1053"><ip.session_id>527</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4787750244140625</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0040531158447265625</time_between_pkts_sum><time_between_pkts_avg>0.0040531158447265625</time_between_pkts_avg><time_between_pkts_max>0.0040531158447265625</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4034250749465986</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4034250749465986</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>3269</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>3269</min_tcp_pkts><max_tcp_pkts>3269</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1054"><ip.session_id>528</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.478895902633667</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.12087821960449219</time_between_pkts_sum><time_between_pkts_avg>0.12087821960449219</time_between_pkts_avg><time_between_pkts_max>0.12087821960449219</time_between_pkts_max><time_between_pkts_min>0.12087821960449219</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40340540275917375</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40340540275917375</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1055"><ip.session_id>528</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.478900909423828</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4034045879762214</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4034045879762214</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>9998</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>9998</min_tcp_pkts><max_tcp_pkts>9998</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1056"><ip.session_id>529</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4789071083068848</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.006198883056640625</time_between_pkts_sum><time_between_pkts_avg>0.006198883056640625</time_between_pkts_avg><time_between_pkts_max>0.006198883056640625</time_between_pkts_max><time_between_pkts_min>0.006198883056640625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4034035792018882</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4034035792018882</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1057"><ip.session_id>529</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4789130687713623</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4034026092313256</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4034026092313256</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>2638</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>2638</min_tcp_pkts><max_tcp_pkts>2638</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1058"><ip.session_id>530</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4789071083068848</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4034035792018882</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4034035792018882</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1059"><ip.session_id>530</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4789209365844727</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.007867813110351562</time_between_pkts_sum><time_between_pkts_avg>0.007867813110351562</time_between_pkts_avg><time_between_pkts_max>0.007867813110351562</time_between_pkts_max><time_between_pkts_min>0.007867813110351562</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40340132887732527</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40340132887732527</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>389</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>389</min_tcp_pkts><max_tcp_pkts>389</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1060"><ip.session_id>531</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4789249897003174</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0040531158447265625</time_between_pkts_sum><time_between_pkts_avg>0.0040531158447265625</time_between_pkts_avg><time_between_pkts_max>0.0040531158447265625</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4034006693041939</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4034006693041939</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1061"><ip.session_id>531</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.478930950164795</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40339969934762476</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40339969934762476</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>13722</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>13722</min_tcp_pkts><max_tcp_pkts>13722</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1062"><ip.session_id>532</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4789350032806396</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0040531158447265625</time_between_pkts_sum><time_between_pkts_avg>0.0040531158447265625</time_between_pkts_avg><time_between_pkts_max>0.0040531158447265625</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.403399039779822</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.403399039779822</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1063"><ip.session_id>532</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4789390563964844</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0040531158447265625</time_between_pkts_sum><time_between_pkts_avg>0.0040531158447265625</time_between_pkts_avg><time_between_pkts_max>0.0040531158447265625</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4033983802141761</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4033983802141761</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>2049</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>2049</min_tcp_pkts><max_tcp_pkts>2049</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1064"><ip.session_id>533</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4789581298828125</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.019073486328125</time_between_pkts_sum><time_between_pkts_avg>0.019073486328125</time_between_pkts_avg><time_between_pkts_max>0.019073486328125</time_between_pkts_max><time_between_pkts_min>0.019073486328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40339527640479866</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40339527640479866</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1065"><ip.session_id>533</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4789628982543945</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.00476837158203125</time_between_pkts_sum><time_between_pkts_avg>0.00476837158203125</time_between_pkts_avg><time_between_pkts_max>0.00476837158203125</time_between_pkts_max><time_between_pkts_min>0.00476837158203125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4033945004599172</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4033945004599172</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>5811</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>5811</min_tcp_pkts><max_tcp_pkts>5811</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1066"><ip.session_id>534</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4789769649505615</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.014066696166992188</time_between_pkts_sum><time_between_pkts_avg>0.014066696166992188</time_between_pkts_avg><time_between_pkts_max>0.014066696166992188</time_between_pkts_max><time_between_pkts_min>0.014066696166992188</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40339221143990867</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40339221143990867</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1067"><ip.session_id>534</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4789819717407227</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4033913967102421</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4033913967102421</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1038</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1038</min_tcp_pkts><max_tcp_pkts>1038</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1068"><ip.session_id>535</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.478998899459839</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.016927719116210938</time_between_pkts_sum><time_between_pkts_avg>0.016927719116210938</time_between_pkts_avg><time_between_pkts_max>0.016927719116210938</time_between_pkts_max><time_between_pkts_min>0.016927719116210938</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4033886421724087</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4033886421724087</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1069"><ip.session_id>535</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.479008913040161</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.010013580322265625</time_between_pkts_sum><time_between_pkts_avg>0.010013580322265625</time_between_pkts_avg><time_between_pkts_max>0.010013580322265625</time_between_pkts_max><time_between_pkts_min>0.010013580322265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40338701274520167</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40338701274520167</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>4000</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>4000</min_tcp_pkts><max_tcp_pkts>4000</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1070"><ip.session_id>536</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.478998899459839</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4033886421724087</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4033886421724087</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1071"><ip.session_id>536</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4790139198303223</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40338619803653447</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40338619803653447</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>43</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>43</min_tcp_pkts><max_tcp_pkts>43</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1072"><ip.session_id>537</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.478998899459839</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4033886421724087</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4033886421724087</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1073"><ip.session_id>537</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.479017972946167</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0040531158447265625</time_between_pkts_sum><time_between_pkts_avg>0.0040531158447265625</time_between_pkts_avg><time_between_pkts_max>0.0040531158447265625</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4033855385128809</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4033855385128809</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>912</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>912</min_tcp_pkts><max_tcp_pkts>912</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1074"><ip.session_id>538</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.479020118713379</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0021457672119140625</time_between_pkts_sum><time_between_pkts_avg>0.0021457672119140625</time_between_pkts_avg><time_between_pkts_max>0.0021457672119140625</time_between_pkts_max><time_between_pkts_min>0.0021457672119140625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40338518935417267</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40338518935417267</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1075"><ip.session_id>538</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4790260791778564</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4033842194720435</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4033842194720435</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>880</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>880</min_tcp_pkts><max_tcp_pkts>880</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1076"><ip.session_id>539</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.479020118713379</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40338518935417267</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40338518935417267</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1077"><ip.session_id>539</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4790310859680176</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4033834047746593</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4033834047746593</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1022</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1022</min_tcp_pkts><max_tcp_pkts>1022</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1078"><ip.session_id>540</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.4791181087493896</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.08702278137207031</time_between_pkts_sum><time_between_pkts_avg>0.08702278137207031</time_between_pkts_avg><time_between_pkts_max>0.08702278137207031</time_between_pkts_max><time_between_pkts_min>0.08702278137207031</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.4033692450838729</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.4033692450838729</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1079"><ip.session_id>540</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.479124069213867</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.40336827527841357</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.40336827527841357</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>8651</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>8651</min_tcp_pkts><max_tcp_pkts>8651</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1080"><ip.session_id>541</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5095760822296143</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>30.45201301574707</time_between_pkts_sum><time_between_pkts_avg>30.45201301574707</time_between_pkts_avg><time_between_pkts_max>30.45201301574707</time_between_pkts_max><time_between_pkts_min>30.45201301574707</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39847367333512257</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39847367333512257</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1081"><ip.session_id>541</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5095889568328857</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.012874603271484375</time_between_pkts_sum><time_between_pkts_avg>0.012874603271484375</time_between_pkts_avg><time_between_pkts_max>0.012874603271484375</time_between_pkts_max><time_between_pkts_min>0.012874603271484375</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3984716290997731</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3984716290997731</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>10012</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>10012</min_tcp_pkts><max_tcp_pkts>10012</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1082"><ip.session_id>542</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5096280574798584</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.03910064697265625</time_between_pkts_sum><time_between_pkts_avg>0.03910064697265625</time_between_pkts_avg><time_between_pkts_max>0.03910064697265625</time_between_pkts_max><time_between_pkts_min>0.03910064697265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3984654208098826</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3984654208098826</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1083"><ip.session_id>542</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5096349716186523</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3984643230226525</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3984643230226525</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>259</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>259</min_tcp_pkts><max_tcp_pkts>259</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1084"><ip.session_id>543</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.509654998779297</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.02002716064453125</time_between_pkts_sum><time_between_pkts_avg>0.02002716064453125</time_between_pkts_avg><time_between_pkts_max>0.02002716064453125</time_between_pkts_max><time_between_pkts_min>0.02002716064453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3984611432592937</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3984611432592937</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1085"><ip.session_id>543</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.509660005569458</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3984603483263836</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3984603483263836</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>54328</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>54328</min_tcp_pkts><max_tcp_pkts>54328</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1086"><ip.session_id>544</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5096640586853027</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0040531158447265625</time_between_pkts_sum><time_between_pkts_avg>0.0040531158447265625</time_between_pkts_avg><time_between_pkts_max>0.0040531158447265625</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39845970481158893</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39845970481158893</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1087"><ip.session_id>544</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.509669065475464</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39845890988441823</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39845890988441823</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>2702</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>2702</min_tcp_pkts><max_tcp_pkts>2702</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1088"><ip.session_id>545</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.509697914123535</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.028848648071289062</time_between_pkts_sum><time_between_pkts_avg>0.028848648071289062</time_between_pkts_avg><time_between_pkts_max>0.028848648071289062</time_between_pkts_max><time_between_pkts_min>0.028848648071289062</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39845432965155536</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39845432965155536</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1089"><ip.session_id>545</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.509704113006592</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.006198883056640625</time_between_pkts_sum><time_between_pkts_avg>0.006198883056640625</time_between_pkts_avg><time_between_pkts_max>0.006198883056640625</time_between_pkts_max><time_between_pkts_min>0.006198883056640625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39845334548303124</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39845334548303124</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>3283</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>3283</min_tcp_pkts><max_tcp_pkts>3283</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1090"><ip.session_id>546</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5097849369049072</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.08082389831542969</time_between_pkts_sum><time_between_pkts_avg>0.08082389831542969</time_between_pkts_avg><time_between_pkts_max>0.08082389831542969</time_between_pkts_max><time_between_pkts_min>0.08082389831542969</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3984405138845125</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3984405138845125</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1091"><ip.session_id>546</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5097920894622803</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.007152557373046875</time_between_pkts_sum><time_between_pkts_avg>0.007152557373046875</time_between_pkts_avg><time_between_pkts_max>0.007152557373046875</time_between_pkts_max><time_between_pkts_min>0.007152557373046875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39843937838462495</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39843937838462495</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>32768</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>32768</min_tcp_pkts><max_tcp_pkts>32768</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1092"><ip.session_id>547</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5098299980163574</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.03790855407714844</time_between_pkts_sum><time_between_pkts_avg>0.03790855407714844</time_between_pkts_avg><time_between_pkts_max>0.03790855407714844</time_between_pkts_max><time_between_pkts_min>0.03790855407714844</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39843336034327004</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39843336034327004</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1093"><ip.session_id>547</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5098369121551514</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39843226273268817</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39843226273268817</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>3851</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>3851</min_tcp_pkts><max_tcp_pkts>3851</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1094"><ip.session_id>548</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.509843111038208</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.006198883056640625</time_between_pkts_sum><time_between_pkts_avg>0.006198883056640625</time_between_pkts_avg><time_between_pkts_max>0.006198883056640625</time_between_pkts_max><time_between_pkts_min>0.006198883056640625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3984312786731699</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3984312786731699</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1095"><ip.session_id>548</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5098490715026855</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39843033246667875</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39843033246667875</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1044</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1044</min_tcp_pkts><max_tcp_pkts>1044</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1096"><ip.session_id>549</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.509843111038208</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3984312786731699</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3984312786731699</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1097"><ip.session_id>549</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.509855031967163</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3984293862646818</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3984293862646818</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>3168</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>3168</min_tcp_pkts><max_tcp_pkts>3168</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1098"><ip.session_id>550</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.509882926940918</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.027894973754882812</time_between_pkts_sum><time_between_pkts_avg>0.027894973754882812</time_between_pkts_avg><time_between_pkts_max>0.027894973754882812</time_between_pkts_max><time_between_pkts_min>0.027894973754882812</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39842495809906747</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39842495809906747</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1099"><ip.session_id>550</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.509890079498291</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.007152557373046875</time_between_pkts_sum><time_between_pkts_avg>0.007152557373046875</time_between_pkts_avg><time_between_pkts_max>0.007152557373046875</time_between_pkts_max><time_between_pkts_min>0.007152557373046875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3984238226878417</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3984238226878417</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1600</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1600</min_tcp_pkts><max_tcp_pkts>1600</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1100"><ip.session_id>551</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.509882926940918</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39842495809906747</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39842495809906747</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1101"><ip.session_id>551</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.509896993637085</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3984227251298081</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3984227251298081</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1055</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1055</min_tcp_pkts><max_tcp_pkts>1055</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1102"><ip.session_id>552</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.509916067123413</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.019073486328125</time_between_pkts_sum><time_between_pkts_avg>0.019073486328125</time_between_pkts_avg><time_between_pkts_max>0.019073486328125</time_between_pkts_max><time_between_pkts_min>0.019073486328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3984196974148577</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3984196974148577</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1103"><ip.session_id>552</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.509921073913574</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3984189026473084</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3984189026473084</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>20222</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>20222</min_tcp_pkts><max_tcp_pkts>20222</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1104"><ip.session_id>553</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.510111093521118</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.1900196075439453</time_between_pkts_sum><time_between_pkts_avg>0.1900196075439453</time_between_pkts_avg><time_between_pkts_max>0.1900196075439453</time_between_pkts_max><time_between_pkts_min>0.1900196075439453</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39838874167008526</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39838874167008526</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1105"><ip.session_id>553</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5101370811462402</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.025033950805664062</time_between_pkts_sum><time_between_pkts_avg>0.025033950805664062</time_between_pkts_avg><time_between_pkts_max>0.025033950805664062</time_between_pkts_max><time_between_pkts_min>0.025033950805664062</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.398384617123522</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.398384617123522</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>5102</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>5102</min_tcp_pkts><max_tcp_pkts>5102</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1106"><ip.session_id>554</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.510111093521118</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39838874167008526</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39838874167008526</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1107"><ip.session_id>554</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5101449489593506</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.007867813110351562</time_between_pkts_sum><time_between_pkts_avg>0.007867813110351562</time_between_pkts_avg><time_between_pkts_max>0.007867813110351562</time_between_pkts_max><time_between_pkts_min>0.007867813110351562</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.398383368424432</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.398383368424432</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>163</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>163</min_tcp_pkts><max_tcp_pkts>163</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1108"><ip.session_id>555</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5101120471954346</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.00095367431640625</time_between_pkts_sum><time_between_pkts_avg>0.00095367431640625</time_between_pkts_avg><time_between_pkts_max>0.00095367431640625</time_between_pkts_max><time_between_pkts_min>0.00095367431640625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3983885903090688</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3983885903090688</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1109"><ip.session_id>555</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5101499557495117</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.398382573801814</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.398382573801814</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>711</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>711</min_tcp_pkts><max_tcp_pkts>711</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1110"><ip.session_id>556</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5101120471954346</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3983885903090688</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3983885903090688</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1111"><ip.session_id>556</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5101521015167236</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0021457672119140625</time_between_pkts_sum><time_between_pkts_avg>0.0021457672119140625</time_between_pkts_avg><time_between_pkts_max>0.0021457672119140625</time_between_pkts_max><time_between_pkts_min>0.0021457672119140625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3983822332502338</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3983822332502338</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>8193</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>8193</min_tcp_pkts><max_tcp_pkts>8193</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1112"><ip.session_id>557</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5102169513702393</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.064849853515625</time_between_pkts_sum><time_between_pkts_avg>0.064849853515625</time_between_pkts_avg><time_between_pkts_max>0.064849853515625</time_between_pkts_max><time_between_pkts_min>0.064849853515625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3983719412993905</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3983719412993905</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1113"><ip.session_id>557</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5102219581604004</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39837114672235735</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39837114672235735</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>3945</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>3945</min_tcp_pkts><max_tcp_pkts>3945</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1114"><ip.session_id>558</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5102438926696777</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.02193450927734375</time_between_pkts_sum><time_between_pkts_avg>0.02193450927734375</time_between_pkts_avg><time_between_pkts_max>0.02193450927734375</time_between_pkts_max><time_between_pkts_min>0.02193450927734375</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3983676657555719</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3983676657555719</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1115"><ip.session_id>558</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5102500915527344</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.006198883056640625</time_between_pkts_sum><time_between_pkts_avg>0.006198883056640625</time_between_pkts_avg><time_between_pkts_max>0.006198883056640625</time_between_pkts_max><time_between_pkts_min>0.006198883056640625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39836668201511444</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39836668201511444</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1461</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1461</min_tcp_pkts><max_tcp_pkts>1461</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1116"><ip.session_id>559</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5102720260620117</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.02193450927734375</time_between_pkts_sum><time_between_pkts_avg>0.02193450927734375</time_between_pkts_avg><time_between_pkts_max>0.02193450927734375</time_between_pkts_max><time_between_pkts_min>0.02193450927734375</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3983632011263535</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3983632011263535</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1117"><ip.session_id>559</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5102789402008057</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3983621039022885</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3983621039022885</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>9110</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>9110</min_tcp_pkts><max_tcp_pkts>9110</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1118"><ip.session_id>560</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5102720260620117</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3983632011263535</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3983632011263535</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1119"><ip.session_id>560</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.510284900665283</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39836115802432503</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39836115802432503</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>8701</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>8701</min_tcp_pkts><max_tcp_pkts>8701</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1120"><ip.session_id>561</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5103089809417725</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.024080276489257812</time_between_pkts_sum><time_between_pkts_avg>0.024080276489257812</time_between_pkts_avg><time_between_pkts_max>0.024080276489257812</time_between_pkts_max><time_between_pkts_min>0.024080276489257812</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3983573367230826</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3983573367230826</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1121"><ip.session_id>561</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.51031494140625</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39835639086775754</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39835639086775754</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1117</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1117</min_tcp_pkts><max_tcp_pkts>1117</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1122"><ip.session_id>562</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5104129314422607</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.09799003601074219</time_between_pkts_sum><time_between_pkts_avg>0.09799003601074219</time_between_pkts_avg><time_between_pkts_max>0.09799003601074219</time_between_pkts_max><time_between_pkts_min>0.09799003601074219</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39834084165009803</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39834084165009803</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1123"><ip.session_id>562</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5104188919067383</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3983398958731027</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3983398958731027</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>70</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>70</min_tcp_pkts><max_tcp_pkts>70</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1124"><ip.session_id>563</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5104401111602783</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.021219253540039062</time_between_pkts_sum><time_between_pkts_avg>0.021219253540039062</time_between_pkts_avg><time_between_pkts_max>0.021219253540039062</time_between_pkts_max><time_between_pkts_min>0.021219253540039062</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3983365289434524</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3983365289434524</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1125"><ip.session_id>563</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.510446071624756</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3983355831869361</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3983355831869361</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1048</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1048</min_tcp_pkts><max_tcp_pkts>1048</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1126"><ip.session_id>564</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.510467052459717</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0209808349609375</time_between_pkts_sum><time_between_pkts_avg>0.0209808349609375</time_between_pkts_avg><time_between_pkts_max>0.0209808349609375</time_between_pkts_max><time_between_pkts_min>0.0209808349609375</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3983322541597252</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3983322541597252</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1127"><ip.session_id>564</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5104730129241943</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3983313084235077</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3983313084235077</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>5666</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>5666</min_tcp_pkts><max_tcp_pkts>5666</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1128"><ip.session_id>565</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5104970932006836</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.024080276489257812</time_between_pkts_sum><time_between_pkts_avg>0.024080276489257812</time_between_pkts_avg><time_between_pkts_max>0.024080276489257812</time_between_pkts_max><time_between_pkts_min>0.024080276489257812</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39832748769490894</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39832748769490894</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1129"><ip.session_id>565</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5105059146881104</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.008821487426757812</time_between_pkts_sum><time_between_pkts_avg>0.008821487426757812</time_between_pkts_avg><time_between_pkts_max>0.008821487426757812</time_between_pkts_max><time_between_pkts_min>0.008821487426757812</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39832608804039954</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39832608804039954</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1061</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1061</min_tcp_pkts><max_tcp_pkts>1061</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1130"><ip.session_id>566</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5104970932006836</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39832748769490894</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39832748769490894</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1131"><ip.session_id>566</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.510512113571167</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.006198883056640625</time_between_pkts_sum><time_between_pkts_avg>0.006198883056640625</time_between_pkts_avg><time_between_pkts_max>0.006198883056640625</time_between_pkts_max><time_between_pkts_min>0.006198883056640625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3983251045052774</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3983251045052774</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>20000</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>20000</min_tcp_pkts><max_tcp_pkts>20000</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1132"><ip.session_id>567</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5104970932006836</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39832748769490894</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39832748769490894</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1133"><ip.session_id>567</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.510517120361328</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39832431011507075</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39832431011507075</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1300</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1300</min_tcp_pkts><max_tcp_pkts>1300</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1134"><ip.session_id>568</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5105221271514893</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39832351572803254</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39832351572803254</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1135"><ip.session_id>568</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.510528087615967</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3983225700333089</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3983225700333089</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>9898</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>9898</min_tcp_pkts><max_tcp_pkts>9898</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1136"><ip.session_id>569</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5105319023132324</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.003814697265625</time_between_pkts_sum><time_between_pkts_avg>0.003814697265625</time_between_pkts_avg><time_between_pkts_max>0.003814697265625</time_between_pkts_max><time_between_pkts_min>0.003814697265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39832196479104237</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39832196479104237</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1137"><ip.session_id>569</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.510535955429077</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0040531158447265625</time_between_pkts_sum><time_between_pkts_avg>0.0040531158447265625</time_between_pkts_avg><time_between_pkts_max>0.0040531158447265625</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39832132172314955</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39832132172314955</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>3</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>3</min_tcp_pkts><max_tcp_pkts>3</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1138"><ip.session_id>570</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.51054310798645</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.007152557373046875</time_between_pkts_sum><time_between_pkts_avg>0.007152557373046875</time_between_pkts_avg><time_between_pkts_max>0.007152557373046875</time_between_pkts_max><time_between_pkts_min>0.007152557373046875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39832018690252147</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39832018690252147</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1139"><ip.session_id>570</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.510546922683716</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.003814697265625</time_between_pkts_sum><time_between_pkts_avg>0.003814697265625</time_between_pkts_avg><time_between_pkts_max>0.003814697265625</time_between_pkts_max><time_between_pkts_min>0.003814697265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39831958166749715</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39831958166749715</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>888</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>888</min_tcp_pkts><max_tcp_pkts>888</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1140"><ip.session_id>571</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.510564088821411</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0171661376953125</time_between_pkts_sum><time_between_pkts_avg>0.0171661376953125</time_between_pkts_avg><time_between_pkts_max>0.0171661376953125</time_between_pkts_max><time_between_pkts_min>0.0171661376953125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3983168581326485</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3983168581326485</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1141"><ip.session_id>571</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.510572910308838</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.008821487426757812</time_between_pkts_sum><time_between_pkts_avg>0.008821487426757812</time_between_pkts_avg><time_between_pkts_max>0.008821487426757812</time_between_pkts_max><time_between_pkts_min>0.008821487426757812</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3983154585528389</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3983154585528389</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>19315</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>19315</min_tcp_pkts><max_tcp_pkts>19315</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1142"><ip.session_id>572</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.510564088821411</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3983168581326485</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3983168581326485</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1143"><ip.session_id>572</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.510577917098999</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.398314664201106</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.398314664201106</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>4444</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>4444</min_tcp_pkts><max_tcp_pkts>4444</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1144"><ip.session_id>573</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.510564088821411</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3983168581326485</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3983168581326485</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1145"><ip.session_id>573</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5105810165405273</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0030994415283203125</time_between_pkts_sum><time_between_pkts_avg>0.0030994415283203125</time_between_pkts_avg><time_between_pkts_max>0.0030994415283203125</time_between_pkts_max><time_between_pkts_min>0.0030994415283203125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39831417246114487</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39831417246114487</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>6789</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>6789</min_tcp_pkts><max_tcp_pkts>6789</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1146"><ip.session_id>574</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5105841159820557</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0030994415283203125</time_between_pkts_sum><time_between_pkts_avg>0.0030994415283203125</time_between_pkts_avg><time_between_pkts_max>0.0030994415283203125</time_between_pkts_max><time_between_pkts_min>0.0030994415283203125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39831368072239787</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39831368072239787</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1147"><ip.session_id>574</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.510590076446533</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39831273507437387</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39831273507437387</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>9002</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>9002</min_tcp_pkts><max_tcp_pkts>9002</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1148"><ip.session_id>575</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.510585069656372</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.00095367431640625</time_between_pkts_sum><time_between_pkts_avg>0.00095367431640625</time_between_pkts_avg><time_between_pkts_max>0.00095367431640625</time_between_pkts_max><time_between_pkts_min>0.00095367431640625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3983135294184123</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3983135294184123</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1149"><ip.session_id>575</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5105929374694824</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.00286102294921875</time_between_pkts_sum><time_between_pkts_avg>0.00286102294921875</time_between_pkts_avg><time_between_pkts_max>0.00286102294921875</time_between_pkts_max><time_between_pkts_min>0.00286102294921875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39831228116491724</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39831228116491724</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>32775</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>32775</min_tcp_pkts><max_tcp_pkts>32775</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1150"><ip.session_id>576</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5106239318847656</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.030994415283203125</time_between_pkts_sum><time_between_pkts_avg>0.030994415283203125</time_between_pkts_avg><time_between_pkts_max>0.030994415283203125</time_between_pkts_max><time_between_pkts_min>0.030994415283203125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3983073638787805</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3983073638787805</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1151"><ip.session_id>576</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5106360912323</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.012159347534179688</time_between_pkts_sum><time_between_pkts_avg>0.012159347534179688</time_between_pkts_avg><time_between_pkts_max>0.012159347534179688</time_between_pkts_max><time_between_pkts_min>0.012159347534179688</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3983054348227617</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3983054348227617</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>4126</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>4126</min_tcp_pkts><max_tcp_pkts>4126</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1152"><ip.session_id>577</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5106239318847656</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3983073638787805</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3983073638787805</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1153"><ip.session_id>577</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5106420516967773</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3983044892138909</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3983044892138909</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>9009</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>9009</min_tcp_pkts><max_tcp_pkts>9009</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1154"><ip.session_id>578</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5106470584869385</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3983036949059092</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3983036949059092</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1155"><ip.session_id>578</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5106539726257324</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.398302598009619</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.398302598009619</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>9090</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>9090</min_tcp_pkts><max_tcp_pkts>9090</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1156"><ip.session_id>579</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5106470584869385</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3983036949059092</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3983036949059092</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1157"><ip.session_id>579</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5106611251831055</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.007152557373046875</time_between_pkts_sum><time_between_pkts_avg>0.007152557373046875</time_between_pkts_avg><time_between_pkts_max>0.007152557373046875</time_between_pkts_max><time_between_pkts_min>0.007152557373046875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3983014632956763</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3983014632956763</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>5033</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>5033</min_tcp_pkts><max_tcp_pkts>5033</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1158"><ip.session_id>580</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5106470584869385</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3983036949059092</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3983036949059092</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1159"><ip.session_id>580</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5106658935546875</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.00476837158203125</time_between_pkts_sum><time_between_pkts_avg>0.00476837158203125</time_between_pkts_avg><time_between_pkts_max>0.00476837158203125</time_between_pkts_max><time_between_pkts_min>0.00476837158203125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3983007068233063</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3983007068233063</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>32776</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>32776</min_tcp_pkts><max_tcp_pkts>32776</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1160"><ip.session_id>581</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.510701894760132</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.03600120544433594</time_between_pkts_sum><time_between_pkts_avg>0.03600120544433594</time_between_pkts_avg><time_between_pkts_max>0.03600120544433594</time_between_pkts_max><time_between_pkts_min>0.03600120544433594</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39829499554965614</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39829499554965614</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1161"><ip.session_id>581</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.510706901550293</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39829420127953896</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39829420127953896</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>8402</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>8402</min_tcp_pkts><max_tcp_pkts>8402</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1162"><ip.session_id>582</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.510741949081421</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.03504753112792969</time_between_pkts_sum><time_between_pkts_avg>0.03504753112792969</time_between_pkts_avg><time_between_pkts_max>0.03504753112792969</time_between_pkts_max><time_between_pkts_min>0.03504753112792969</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3982886414774165</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3982886414774165</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1163"><ip.session_id>582</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5107500553131104</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.008106231689453125</time_between_pkts_sum><time_between_pkts_avg>0.008106231689453125</time_between_pkts_avg><time_between_pkts_max>0.008106231689453125</time_between_pkts_max><time_between_pkts_min>0.008106231689453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3982873555588918</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3982873555588918</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1057</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1057</min_tcp_pkts><max_tcp_pkts>1057</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1164"><ip.session_id>583</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.510741949081421</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3982886414774165</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3982886414774165</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1165"><ip.session_id>583</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5107550621032715</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3982865613192452</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3982865613192452</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>7627</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>7627</min_tcp_pkts><max_tcp_pkts>7627</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1166"><ip.session_id>584</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5107600688934326</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3982857670827663</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3982857670827663</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1167"><ip.session_id>584</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5107650756835938</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.398284972849455</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.398284972849455</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>5200</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>5200</min_tcp_pkts><max_tcp_pkts>5200</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1168"><ip.session_id>585</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5107789039611816</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.013828277587890625</time_between_pkts_sum><time_between_pkts_avg>0.013828277587890625</time_between_pkts_avg><time_between_pkts_max>0.013828277587890625</time_between_pkts_max><time_between_pkts_min>0.013828277587890625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3982827792691461</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3982827792691461</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1169"><ip.session_id>585</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5107839107513428</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.398281985047751</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.398281985047751</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>7938</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>7938</min_tcp_pkts><max_tcp_pkts>7938</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1170"><ip.session_id>586</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5108089447021484</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.025033950805664062</time_between_pkts_sum><time_between_pkts_avg>0.025033950805664062</time_between_pkts_avg><time_between_pkts_max>0.025033950805664062</time_between_pkts_max><time_between_pkts_min>0.025033950805664062</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39827801398828766</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39827801398828766</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1171"><ip.session_id>586</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5108160972595215</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.007152557373046875</time_between_pkts_sum><time_between_pkts_avg>0.007152557373046875</time_between_pkts_avg><time_between_pkts_max>0.007152557373046875</time_between_pkts_max><time_between_pkts_min>0.007152557373046875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.398276879414414</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.398276879414414</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>2323</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>2323</min_tcp_pkts><max_tcp_pkts>2323</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1172"><ip.session_id>587</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5108089447021484</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39827801398828766</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39827801398828766</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1173"><ip.session_id>587</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.510822057723999</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3982759339411238</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3982759339411238</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>5679</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>5679</min_tcp_pkts><max_tcp_pkts>5679</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1174"><ip.session_id>588</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.510845899581909</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.02384185791015625</time_between_pkts_sum><time_between_pkts_avg>0.02384185791015625</time_between_pkts_avg><time_between_pkts_max>0.02384185791015625</time_between_pkts_max><time_between_pkts_min>0.02384185791015625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39827215209285205</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39827215209285205</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1175"><ip.session_id>588</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5108509063720703</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39827135791383983</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39827135791383983</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>2909</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>2909</min_tcp_pkts><max_tcp_pkts>2909</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1176"><ip.session_id>589</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5108721256256104</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.021219253540039062</time_between_pkts_sum><time_between_pkts_avg>0.021219253540039062</time_between_pkts_avg><time_between_pkts_max>0.021219253540039062</time_between_pkts_max><time_between_pkts_min>0.021219253540039062</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.398267992142706</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.398267992142706</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1177"><ip.session_id>589</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.510878086090088</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3982670467116104</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3982670467116104</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>16992</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>16992</min_tcp_pkts><max_tcp_pkts>16992</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1178"><ip.session_id>590</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5108840465545654</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3982661012850035</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3982661012850035</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1179"><ip.session_id>590</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.51088809967041</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0040531158447265625</time_between_pkts_sum><time_between_pkts_avg>0.0040531158447265625</time_between_pkts_avg><time_between_pkts_max>0.0040531158447265625</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3982654583974747</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3982654583974747</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>3659</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>3659</min_tcp_pkts><max_tcp_pkts>3659</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1180"><ip.session_id>591</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5123660564422607</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>1.477956771850586</time_between_pkts_sum><time_between_pkts_avg>1.477956771850586</time_between_pkts_avg><time_between_pkts_max>1.477956771850586</time_between_pkts_max><time_between_pkts_min>1.477956771850586</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3980311696361999</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3980311696361999</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1181"><ip.session_id>591</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.512376070022583</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.010013580322265625</time_between_pkts_sum><time_between_pkts_avg>0.010013580322265625</time_between_pkts_avg><time_between_pkts_max>0.010013580322265625</time_between_pkts_max><time_between_pkts_min>0.010013580322265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3980295832028886</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3980295832028886</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1077</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1077</min_tcp_pkts><max_tcp_pkts>1077</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1182"><ip.session_id>592</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5123660564422607</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3980311696361999</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3980311696361999</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1183"><ip.session_id>592</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.512382984161377</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3980284878158398</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3980284878158398</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>2811</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>2811</min_tcp_pkts><max_tcp_pkts>2811</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1184"><ip.session_id>593</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.512455940246582</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.07295608520507812</time_between_pkts_sum><time_between_pkts_avg>0.07295608520507812</time_between_pkts_avg><time_between_pkts_max>0.07295608520507812</time_between_pkts_max><time_between_pkts_min>0.07295608520507812</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39801692996130955</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39801692996130955</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1185"><ip.session_id>593</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.512463092803955</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.007152557373046875</time_between_pkts_sum><time_between_pkts_avg>0.007152557373046875</time_between_pkts_avg><time_between_pkts_max>0.007152557373046875</time_between_pkts_max><time_between_pkts_min>0.007152557373046875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39801579687444544</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39801579687444544</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>35500</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>35500</min_tcp_pkts><max_tcp_pkts>35500</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1186"><ip.session_id>594</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5124669075012207</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.003814697265625</time_between_pkts_sum><time_between_pkts_avg>0.003814697265625</time_between_pkts_avg><time_between_pkts_max>0.003814697265625</time_between_pkts_max><time_between_pkts_min>0.003814697265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3980151925640892</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3980151925640892</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1187"><ip.session_id>594</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5124709606170654</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0040531158447265625</time_between_pkts_sum><time_between_pkts_avg>0.0040531158447265625</time_between_pkts_avg><time_between_pkts_max>0.0040531158447265625</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3980145504863463</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3980145504863463</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>49155</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>49155</min_tcp_pkts><max_tcp_pkts>49155</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1188"><ip.session_id>595</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5125091075897217</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.03814697265625</time_between_pkts_sum><time_between_pkts_avg>0.03814697265625</time_between_pkts_avg><time_between_pkts_max>0.03814697265625</time_between_pkts_max><time_between_pkts_min>0.03814697265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39800850750320715</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39800850750320715</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1189"><ip.session_id>595</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5125160217285156</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3980074122321568</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3980074122321568</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>5952</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>5952</min_tcp_pkts><max_tcp_pkts>5952</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1190"><ip.session_id>596</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5125210285186768</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39800661910860763</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39800661910860763</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1191"><ip.session_id>596</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5125250816345215</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0040531158447265625</time_between_pkts_sum><time_between_pkts_avg>0.0040531158447265625</time_between_pkts_avg><time_between_pkts_max>0.0040531158447265625</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3980059770585258</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3980059770585258</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>3006</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>3006</min_tcp_pkts><max_tcp_pkts>3006</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1192"><ip.session_id>597</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.512540102005005</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.015020370483398438</time_between_pkts_sum><time_between_pkts_avg>0.015020370483398438</time_between_pkts_avg><time_between_pkts_max>0.015020370483398438</time_between_pkts_max><time_between_pkts_min>0.015020370483398438</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3980035977145204</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3980035977145204</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1193"><ip.session_id>597</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5125479698181152</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.007867813110351562</time_between_pkts_sum><time_between_pkts_avg>0.007867813110351562</time_between_pkts_avg><time_between_pkts_max>0.007867813110351562</time_between_pkts_max><time_between_pkts_min>0.007867813110351562</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3980023514028234</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3980023514028234</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>50003</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>50003</min_tcp_pkts><max_tcp_pkts>50003</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1194"><ip.session_id>598</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.512540102005005</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3980035977145204</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3980035977145204</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1195"><ip.session_id>598</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5125539302825928</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3980014072324918</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3980014072324918</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>3077</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>3077</min_tcp_pkts><max_tcp_pkts>3077</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1196"><ip.session_id>599</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.512557029724121</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0030994415283203125</time_between_pkts_sum><time_between_pkts_avg>0.0030994415283203125</time_between_pkts_avg><time_between_pkts_max>0.0030994415283203125</time_between_pkts_max><time_between_pkts_min>0.0030994415283203125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39800091626568973</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39800091626568973</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1197"><ip.session_id>599</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.512561082839966</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0040531158447265625</time_between_pkts_sum><time_between_pkts_avg>0.0040531158447265625</time_between_pkts_avg><time_between_pkts_max>0.0040531158447265625</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.398000274234007</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.398000274234007</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>2020</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>2020</min_tcp_pkts><max_tcp_pkts>2020</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1198"><ip.session_id>600</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.512579917907715</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.018835067749023438</time_between_pkts_sum><time_between_pkts_avg>0.018835067749023438</time_between_pkts_avg><time_between_pkts_max>0.018835067749023438</time_between_pkts_max><time_between_pkts_min>0.018835067749023438</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3979972907021894</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3979972907021894</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1199"><ip.session_id>600</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.512584924697876</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3979964976189787</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3979964976189787</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1234</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1234</min_tcp_pkts><max_tcp_pkts>1234</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1200"><ip.session_id>601</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5125999450683594</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.015020370483398438</time_between_pkts_sum><time_between_pkts_avg>0.015020370483398438</time_between_pkts_avg><time_between_pkts_max>0.015020370483398438</time_between_pkts_max><time_between_pkts_min>0.015020370483398438</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3979941183883109</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3979941183883109</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1201"><ip.session_id>601</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5126049518585205</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39799332531774295</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39799332531774295</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1094</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1094</min_tcp_pkts><max_tcp_pkts>1094</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1202"><ip.session_id>602</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5126700401306152</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.06508827209472656</time_between_pkts_sum><time_between_pkts_avg>0.06508827209472656</time_between_pkts_avg><time_between_pkts_max>0.06508827209472656</time_between_pkts_max><time_between_pkts_min>0.06508827209472656</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39798301568797206</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39798301568797206</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1203"><ip.session_id>602</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.512676954269409</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3979819205572178</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3979819205572178</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>5550</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>5550</min_tcp_pkts><max_tcp_pkts>5550</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1204"><ip.session_id>603</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5126819610595703</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39798112753526155</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39798112753526155</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1205"><ip.session_id>603</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.512686014175415</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0040531158447265625</time_between_pkts_sum><time_between_pkts_avg>0.0040531158447265625</time_between_pkts_avg><time_between_pkts_max>0.0040531158447265625</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39798048556742127</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39798048556742127</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>3071</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>3071</min_tcp_pkts><max_tcp_pkts>3071</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1206"><ip.session_id>604</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.51269793510437</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.011920928955078125</time_between_pkts_sum><time_between_pkts_avg>0.011920928955078125</time_between_pkts_avg><time_between_pkts_max>0.011920928955078125</time_between_pkts_max><time_between_pkts_min>0.011920928955078125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39797859743871794</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39797859743871794</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1207"><ip.session_id>604</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.512705087661743</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.007152557373046875</time_between_pkts_sum><time_between_pkts_avg>0.007152557373046875</time_between_pkts_avg><time_between_pkts_max>0.007152557373046875</time_between_pkts_max><time_between_pkts_min>0.007152557373046875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3979774645700955</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3979774645700955</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>999</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>999</min_tcp_pkts><max_tcp_pkts>999</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1208"><ip.session_id>605</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.51269793510437</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39797859743871794</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39797859743871794</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1209"><ip.session_id>605</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5127110481262207</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3979765205178368</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3979765205178368</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>7402</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>7402</min_tcp_pkts><max_tcp_pkts>7402</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1210"><ip.session_id>606</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5127499103546143</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.03886222839355469</time_between_pkts_sum><time_between_pkts_avg>0.03886222839355469</time_between_pkts_avg><time_between_pkts_max>0.03886222839355469</time_between_pkts_max><time_between_pkts_min>0.03886222839355469</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39797036540690756</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39797036540690756</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1211"><ip.session_id>606</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5127570629119873</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.007152557373046875</time_between_pkts_sum><time_between_pkts_avg>0.007152557373046875</time_between_pkts_avg><time_between_pkts_max>0.007152557373046875</time_between_pkts_max><time_between_pkts_min>0.007152557373046875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3979692325851504</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3979692325851504</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>7920</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>7920</min_tcp_pkts><max_tcp_pkts>7920</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1212"><ip.session_id>607</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5127499103546143</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39797036540690756</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39797036540690756</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1213"><ip.session_id>607</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5127620697021484</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3979684396137576</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3979684396137576</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>636</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>636</min_tcp_pkts><max_tcp_pkts>636</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1214"><ip.session_id>608</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5128109455108643</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.04887580871582031</time_between_pkts_sum><time_between_pkts_avg>0.04887580871582031</time_between_pkts_avg><time_between_pkts_max>0.04887580871582031</time_between_pkts_max><time_between_pkts_min>0.04887580871582031</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3979606988685319</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3979606988685319</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1215"><ip.session_id>608</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.512816905975342</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39795975489581215</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39795975489581215</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>4242</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>4242</min_tcp_pkts><max_tcp_pkts>4242</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1216"><ip.session_id>609</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5131070613861084</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.29015541076660156</time_between_pkts_sum><time_between_pkts_avg>0.29015541076660156</time_between_pkts_avg><time_between_pkts_max>0.29015541076660156</time_between_pkts_max><time_between_pkts_min>0.29015541076660156</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3979138077183422</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3979138077183422</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1217"><ip.session_id>609</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5131161212921143</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.009059906005859375</time_between_pkts_sum><time_between_pkts_avg>0.009059906005859375</time_between_pkts_avg><time_between_pkts_max>0.009059906005859375</time_between_pkts_max><time_between_pkts_min>0.009059906005859375</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39791237321968703</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39791237321968703</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1079</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1079</min_tcp_pkts><max_tcp_pkts>1079</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1218"><ip.session_id>610</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5131070613861084</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3979138077183422</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3979138077183422</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1219"><ip.session_id>610</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5131211280822754</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39791158047486747</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39791158047486747</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>32780</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>32780</min_tcp_pkts><max_tcp_pkts>32780</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1220"><ip.session_id>611</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5131280422210693</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39791048573721427</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39791048573721427</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1221"><ip.session_id>611</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.513139009475708</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.010967254638671875</time_between_pkts_sum><time_between_pkts_avg>0.010967254638671875</time_between_pkts_avg><time_between_pkts_max>0.010967254638671875</time_between_pkts_max><time_between_pkts_min>0.010967254638671875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3979087492691542</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3979087492691542</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1500</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1500</min_tcp_pkts><max_tcp_pkts>1500</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1222"><ip.session_id>612</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5131280422210693</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39791048573721427</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39791048573721427</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1223"><ip.session_id>612</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5131449699401855</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39790780554286953</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39790780554286953</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>8654</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>8654</min_tcp_pkts><max_tcp_pkts>8654</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1224"><ip.session_id>613</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5131280422210693</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39791048573721427</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39791048573721427</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1225"><ip.session_id>613</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5131490230560303</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0040531158447265625</time_between_pkts_sum><time_between_pkts_avg>0.0040531158447265625</time_between_pkts_avg><time_between_pkts_max>0.0040531158447265625</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3979071638115529</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3979071638115529</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>2522</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>2522</min_tcp_pkts><max_tcp_pkts>2522</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1226"><ip.session_id>614</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5131280422210693</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39791048573721427</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39791048573721427</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1227"><ip.session_id>614</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5131540298461914</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39790637108749016</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39790637108749016</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>8089</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>8089</min_tcp_pkts><max_tcp_pkts>8089</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1228"><ip.session_id>615</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5131280422210693</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39791048573721427</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39791048573721427</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1229"><ip.session_id>615</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5131571292877197</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0030994415283203125</time_between_pkts_sum><time_between_pkts_avg>0.0030994415283203125</time_between_pkts_avg><time_between_pkts_max>0.0030994415283203125</time_between_pkts_max><time_between_pkts_min>0.0030994415283203125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39790588035512947</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39790588035512947</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>4445</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>4445</min_tcp_pkts><max_tcp_pkts>4445</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1230"><ip.session_id>616</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5131609439849854</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.003814697265625</time_between_pkts_sum><time_between_pkts_avg>0.003814697265625</time_between_pkts_avg><time_between_pkts_max>0.003814697265625</time_between_pkts_max><time_between_pkts_min>0.003814697265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.397905276378501</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.397905276378501</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1231"><ip.session_id>616</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5131659507751465</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39790448366195863</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39790448366195863</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>50000</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>50000</min_tcp_pkts><max_tcp_pkts>50000</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1232"><ip.session_id>617</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5136680603027344</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.5021095275878906</time_between_pkts_sum><time_between_pkts_avg>0.5021095275878906</time_between_pkts_avg><time_between_pkts_max>0.5021095275878906</time_between_pkts_max><time_between_pkts_min>0.5021095275878906</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3978250015555215</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3978250015555215</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1233"><ip.session_id>617</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5136730670928955</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39782420915879746</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39782420915879746</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40193</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40193</min_tcp_pkts><max_tcp_pkts>40193</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1234"><ip.session_id>618</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.51371693611145</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0438690185546875</time_between_pkts_sum><time_between_pkts_avg>0.0438690185546875</time_between_pkts_avg><time_between_pkts_max>0.0438690185546875</time_between_pkts_max><time_between_pkts_min>0.0438690185546875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39781726638916326</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39781726638916326</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1235"><ip.session_id>618</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5137219429016113</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39781647402325304</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39781647402325304</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>5633</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>5633</min_tcp_pkts><max_tcp_pkts>5633</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1236"><ip.session_id>619</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.513772964477539</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.051021575927734375</time_between_pkts_sum><time_between_pkts_avg>0.051021575927734375</time_between_pkts_avg><time_between_pkts_max>0.051021575927734375</time_between_pkts_max><time_between_pkts_min>0.051021575927734375</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3978083996172818</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3978083996172818</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1237"><ip.session_id>619</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5137789249420166</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39780745636693815</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39780745636693815</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>617</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>617</min_tcp_pkts><max_tcp_pkts>617</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1238"><ip.session_id>620</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.513801097869873</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.022172927856445312</time_between_pkts_sum><time_between_pkts_avg>0.022172927856445312</time_between_pkts_avg><time_between_pkts_max>0.022172927856445312</time_between_pkts_max><time_between_pkts_min>0.022172927856445312</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39780394751492987</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39780394751492987</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1239"><ip.session_id>620</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.513808012008667</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3978028533694371</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3978028533694371</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1971</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1971</min_tcp_pkts><max_tcp_pkts>1971</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1240"><ip.session_id>621</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5138120651245117</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0040531158447265625</time_between_pkts_sum><time_between_pkts_avg>0.0040531158447265625</time_between_pkts_avg><time_between_pkts_max>0.0040531158447265625</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39780221197660176</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39780221197660176</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1241"><ip.session_id>621</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5138161182403564</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0040531158447265625</time_between_pkts_sum><time_between_pkts_avg>0.0040531158447265625</time_between_pkts_avg><time_between_pkts_max>0.0040531158447265625</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39780157058583465</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39780157058583465</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1755</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1755</min_tcp_pkts><max_tcp_pkts>1755</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1242"><ip.session_id>622</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5448288917541504</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>31.012773513793945</time_between_pkts_sum><time_between_pkts_avg>31.012773513793945</time_between_pkts_avg><time_between_pkts_max>31.012773513793945</time_between_pkts_max><time_between_pkts_min>31.012773513793945</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3929537279462039</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3929537279462039</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1243"><ip.session_id>622</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.544856071472168</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.027179718017578125</time_between_pkts_sum><time_between_pkts_avg>0.027179718017578125</time_between_pkts_avg><time_between_pkts_max>0.027179718017578125</time_between_pkts_max><time_between_pkts_min>0.027179718017578125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3929495310992233</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3929495310992233</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>20</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>20</min_tcp_pkts><max_tcp_pkts>20</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1244"><ip.session_id>623</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5448288917541504</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3929537279462039</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3929537279462039</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1245"><ip.session_id>623</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5448660850524902</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.010013580322265625</time_between_pkts_sum><time_between_pkts_avg>0.010013580322265625</time_between_pkts_avg><time_between_pkts_max>0.010013580322265625</time_between_pkts_max><time_between_pkts_min>0.010013580322265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3929479849150389</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3929479849150389</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>6106</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>6106</min_tcp_pkts><max_tcp_pkts>6106</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1246"><ip.session_id>624</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5448288917541504</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3929537279462039</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3929537279462039</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1247"><ip.session_id>624</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.544869899749756</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.003814697265625</time_between_pkts_sum><time_between_pkts_avg>0.003814697265625</time_between_pkts_avg><time_between_pkts_max>0.003814697265625</time_between_pkts_max><time_between_pkts_min>0.003814697265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39294739589569305</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39294739589569305</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>3476</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>3476</min_tcp_pkts><max_tcp_pkts>3476</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1248"><ip.session_id>625</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5448739528656006</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0040531158447265625</time_between_pkts_sum><time_between_pkts_avg>0.0040531158447265625</time_between_pkts_avg><time_between_pkts_max>0.0040531158447265625</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39294677006457296</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39294677006457296</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1249"><ip.session_id>625</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.544879913330078</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39294584972831176</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39294584972831176</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>8002</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>8002</min_tcp_pkts><max_tcp_pkts>8002</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1250"><ip.session_id>626</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5448739528656006</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39294677006457296</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39294677006457296</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1251"><ip.session_id>626</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5448830127716064</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0030994415283203125</time_between_pkts_sum><time_between_pkts_avg>0.0030994415283203125</time_between_pkts_avg><time_between_pkts_max>0.0030994415283203125</time_between_pkts_max><time_between_pkts_min>0.0030994415283203125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3929453711551597</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3929453711551597</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>8090</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>8090</min_tcp_pkts><max_tcp_pkts>8090</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1252"><ip.session_id>627</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5449109077453613</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.027894973754882812</time_between_pkts_sum><time_between_pkts_avg>0.027894973754882812</time_between_pkts_avg><time_between_pkts_max>0.027894973754882812</time_between_pkts_max><time_between_pkts_min>0.027894973754882812</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39294106404924806</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39294106404924806</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1253"><ip.session_id>627</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5449159145355225</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3929402909889508</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3929402909889508</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>9010</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>9010</min_tcp_pkts><max_tcp_pkts>9010</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1254"><ip.session_id>628</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5449399948120117</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.024080276489257812</time_between_pkts_sum><time_between_pkts_avg>0.024080276489257812</time_between_pkts_avg><time_between_pkts_max>0.024080276489257812</time_between_pkts_max><time_between_pkts_min>0.024080276489257812</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39293657297953993</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39293657297953993</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1255"><ip.session_id>628</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.544948101043701</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.008106231689453125</time_between_pkts_sum><time_between_pkts_avg>0.008106231689453125</time_between_pkts_avg><time_between_pkts_max>0.008106231689453125</time_between_pkts_max><time_between_pkts_min>0.008106231689453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3929353213882409</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3929353213882409</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1002</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1002</min_tcp_pkts><max_tcp_pkts>1002</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1256"><ip.session_id>629</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5449399948120117</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39293657297953993</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39293657297953993</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1257"><ip.session_id>629</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5449531078338623</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3929345483505393</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3929345483505393</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1060</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1060</min_tcp_pkts><max_tcp_pkts>1060</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1258"><ip.session_id>630</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.544956922531128</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.003814697265625</time_between_pkts_sum><time_between_pkts_avg>0.003814697265625</time_between_pkts_avg><time_between_pkts_max>0.003814697265625</time_between_pkts_max><time_between_pkts_min>0.003814697265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3929339593714749</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3929339593714749</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1259"><ip.session_id>630</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5449609756469727</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0040531158447265625</time_between_pkts_sum><time_between_pkts_avg>0.0040531158447265625</time_between_pkts_avg><time_between_pkts_max>0.0040531158447265625</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39293333358315363</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39293333358315363</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>3869</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>3869</min_tcp_pkts><max_tcp_pkts>3869</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1260"><ip.session_id>631</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5450549125671387</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.09393692016601562</time_between_pkts_sum><time_between_pkts_avg>0.09393692016601562</time_between_pkts_avg><time_between_pkts_max>0.09393692016601562</time_between_pkts_max><time_between_pkts_min>0.09393692016601562</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39291883057694926</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39291883057694926</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1261"><ip.session_id>631</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5450611114501953</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.006198883056640625</time_between_pkts_sum><time_between_pkts_avg>0.006198883056640625</time_between_pkts_avg><time_between_pkts_max>0.006198883056640625</time_between_pkts_max><time_between_pkts_min>0.006198883056640625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3929178735634337</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3929178735634337</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>4443</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>4443</min_tcp_pkts><max_tcp_pkts>4443</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1262"><ip.session_id>632</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.545114040374756</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.052928924560546875</time_between_pkts_sum><time_between_pkts_avg>0.052928924560546875</time_between_pkts_avg><time_between_pkts_max>0.052928924560546875</time_between_pkts_max><time_between_pkts_min>0.052928924560546875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39290970233017725</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39290970233017725</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1263"><ip.session_id>632</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.545119047164917</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3929089293932751</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3929089293932751</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>15000</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>15000</min_tcp_pkts><max_tcp_pkts>15000</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1264"><ip.session_id>633</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.545135021209717</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.015974044799804688</time_between_pkts_sum><time_between_pkts_avg>0.015974044799804688</time_between_pkts_avg><time_between_pkts_max>0.015974044799804688</time_between_pkts_max><time_between_pkts_min>0.015974044799804688</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39290646337682095</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39290646337682095</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1265"><ip.session_id>633</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5451409816741943</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39290554322935767</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39290554322935767</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>512</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>512</min_tcp_pkts><max_tcp_pkts>512</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1266"><ip.session_id>634</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.545167922973633</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.026941299438476562</time_between_pkts_sum><time_between_pkts_avg>0.026941299438476562</time_between_pkts_avg><time_between_pkts_max>0.026941299438476562</time_between_pkts_max><time_between_pkts_min>0.026941299438476562</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39290138421658855</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39290138421658855</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1267"><ip.session_id>634</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.545175075531006</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.007152557373046875</time_between_pkts_sum><time_between_pkts_avg>0.007152557373046875</time_between_pkts_avg><time_between_pkts_max>0.007152557373046875</time_between_pkts_max><time_between_pkts_min>0.007152557373046875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3929002800686973</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3929002800686973</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>9968</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>9968</min_tcp_pkts><max_tcp_pkts>9968</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1268"><ip.session_id>635</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.545167922973633</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39290138421658855</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39290138421658855</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1269"><ip.session_id>635</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5451819896698</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3928992127316347</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3928992127316347</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1042</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1042</min_tcp_pkts><max_tcp_pkts>1042</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1270"><ip.session_id>636</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5451860427856445</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0040531158447265625</time_between_pkts_sum><time_between_pkts_avg>0.0040531158447265625</time_between_pkts_avg><time_between_pkts_max>0.0040531158447265625</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3928985870539838</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3928985870539838</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1271"><ip.session_id>636</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5451900959014893</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0040531158447265625</time_between_pkts_sum><time_between_pkts_avg>0.0040531158447265625</time_between_pkts_avg><time_between_pkts_max>0.0040531158447265625</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39289796137832556</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39289796137832556</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>2107</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>2107</min_tcp_pkts><max_tcp_pkts>2107</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1272"><ip.session_id>637</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.545197010040283</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39289689405386063</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39289689405386063</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1273"><ip.session_id>637</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5452020168304443</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39289612116735084</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39289612116735084</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>2196</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>2196</min_tcp_pkts><max_tcp_pkts>2196</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1274"><ip.session_id>638</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.545228958129883</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.026941299438476562</time_between_pkts_sum><time_between_pkts_avg>0.026941299438476562</time_between_pkts_avg><time_between_pkts_max>0.026941299438476562</time_between_pkts_max><time_between_pkts_min>0.026941299438476562</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3928919623540485</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3928919623540485</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1275"><ip.session_id>638</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.545236110687256</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.007152557373046875</time_between_pkts_sum><time_between_pkts_avg>0.007152557373046875</time_between_pkts_avg><time_between_pkts_max>0.007152557373046875</time_between_pkts_max><time_between_pkts_min>0.007152557373046875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39289085825911196</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39289085825911196</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>50006</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>50006</min_tcp_pkts><max_tcp_pkts>50006</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1276"><ip.session_id>639</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.545241117477417</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39289008539634857</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39289008539634857</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1277"><ip.session_id>639</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5452449321746826</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.003814697265625</time_between_pkts_sum><time_between_pkts_avg>0.003814697265625</time_between_pkts_avg><time_between_pkts_max>0.003814697265625</time_between_pkts_max><time_between_pkts_min>0.003814697265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3928894965505697</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3928894965505697</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>9900</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>9900</min_tcp_pkts><max_tcp_pkts>9900</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1278"><ip.session_id>640</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.545300006866455</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.05507469177246094</time_between_pkts_sum><time_between_pkts_avg>0.05507469177246094</time_between_pkts_avg><time_between_pkts_max>0.05507469177246094</time_between_pkts_max><time_between_pkts_min>0.05507469177246094</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3928809952863318</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3928809952863318</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1279"><ip.session_id>640</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5453081130981445</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.008106231689453125</time_between_pkts_sum><time_between_pkts_avg>0.008106231689453125</time_between_pkts_avg><time_between_pkts_max>0.008106231689453125</time_between_pkts_max><time_between_pkts_min>0.008106231689453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.392879744049062</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.392879744049062</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>6112</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>6112</min_tcp_pkts><max_tcp_pkts>6112</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1280"><ip.session_id>641</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5455739498138428</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.2658367156982422</time_between_pkts_sum><time_between_pkts_avg>0.2658367156982422</time_between_pkts_avg><time_between_pkts_max>0.2658367156982422</time_between_pkts_max><time_between_pkts_min>0.2658367156982422</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.392838715242639</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.392838715242639</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1281"><ip.session_id>641</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.545581102371216</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.007152557373046875</time_between_pkts_sum><time_between_pkts_avg>0.007152557373046875</time_between_pkts_avg><time_between_pkts_max>0.007152557373046875</time_between_pkts_max><time_between_pkts_min>0.007152557373046875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39283761144694906</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39283761144694906</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1311</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1311</min_tcp_pkts><max_tcp_pkts>1311</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1282"><ip.session_id>642</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5455739498138428</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.392838715242639</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.392838715242639</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1283"><ip.session_id>642</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.545586109161377</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39283683879365683</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39283683879365683</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>5988</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>5988</min_tcp_pkts><max_tcp_pkts>5988</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1284"><ip.session_id>643</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5456368923187256</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.05078315734863281</time_between_pkts_sum><time_between_pkts_avg>0.05078315734863281</time_between_pkts_avg><time_between_pkts_max>0.05078315734863281</time_between_pkts_max><time_between_pkts_min>0.05078315734863281</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3928290020534458</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3928290020534458</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1285"><ip.session_id>643</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5456459522247314</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.009059906005859375</time_between_pkts_sum><time_between_pkts_avg>0.009059906005859375</time_between_pkts_avg><time_between_pkts_max>0.009059906005859375</time_between_pkts_max><time_between_pkts_min>0.009059906005859375</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.392827603982425</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.392827603982425</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>2557</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>2557</min_tcp_pkts><max_tcp_pkts>2557</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1286"><ip.session_id>644</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5456368923187256</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3928290020534458</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3928290020534458</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1287"><ip.session_id>644</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5456509590148926</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3928268313684986</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3928268313684986</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>5915</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>5915</min_tcp_pkts><max_tcp_pkts>5915</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1288"><ip.session_id>645</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5456531047821045</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0021457672119140625</time_between_pkts_sum><time_between_pkts_avg>0.0021457672119140625</time_between_pkts_avg><time_between_pkts_max>0.0021457672119140625</time_between_pkts_max><time_between_pkts_min>0.0021457672119140625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3928265002491748</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3928265002491748</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1289"><ip.session_id>645</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.545659065246582</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3928255804762042</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3928255804762042</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>720</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>720</min_tcp_pkts><max_tcp_pkts>720</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1290"><ip.session_id>646</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.545654058456421</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.00095367431640625</time_between_pkts_sum><time_between_pkts_avg>0.00095367431640625</time_between_pkts_avg><time_between_pkts_max>0.00095367431640625</time_between_pkts_max><time_between_pkts_min>0.00095367431640625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3928263530852101</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3928263530852101</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1291"><ip.session_id>646</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.545665979385376</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3928245135449543</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3928245135449543</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>9878</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>9878</min_tcp_pkts><max_tcp_pkts>9878</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1292"><ip.session_id>647</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.545668125152588</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0021457672119140625</time_between_pkts_sum><time_between_pkts_avg>0.0021457672119140625</time_between_pkts_avg><time_between_pkts_max>0.0021457672119140625</time_between_pkts_max><time_between_pkts_min>0.0021457672119140625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3928241824295379</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3928241824295379</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1293"><ip.session_id>647</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.54567289352417</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.00476837158203125</time_between_pkts_sum><time_between_pkts_avg>0.00476837158203125</time_between_pkts_avg><time_between_pkts_max>0.00476837158203125</time_between_pkts_max><time_between_pkts_min>0.00476837158203125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3928234466195</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3928234466195</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>2190</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>2190</min_tcp_pkts><max_tcp_pkts>2190</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1294"><ip.session_id>648</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.545668125152588</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3928241824295379</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3928241824295379</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1295"><ip.session_id>648</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5456809997558594</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.008106231689453125</time_between_pkts_sum><time_between_pkts_avg>0.008106231689453125</time_between_pkts_avg><time_between_pkts_max>0.008106231689453125</time_between_pkts_max><time_between_pkts_min>0.008106231689453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39282219574876187</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39282219574876187</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1021</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1021</min_tcp_pkts><max_tcp_pkts>1021</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1296"><ip.session_id>649</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.545682907104492</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0019073486328125</time_between_pkts_sum><time_between_pkts_avg>0.0019073486328125</time_between_pkts_avg><time_between_pkts_max>0.0019073486328125</time_between_pkts_max><time_between_pkts_min>0.0019073486328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.392821901427393</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.392821901427393</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1297"><ip.session_id>649</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5456879138946533</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.392821128835898</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.392821128835898</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>2003</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>2003</min_tcp_pkts><max_tcp_pkts>2003</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1298"><ip.session_id>650</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.545682907104492</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.392821901427393</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.392821901427393</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1299"><ip.session_id>650</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5456910133361816</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0030994415283203125</time_between_pkts_sum><time_between_pkts_avg>0.0030994415283203125</time_between_pkts_avg><time_between_pkts_max>0.0030994415283203125</time_between_pkts_max><time_between_pkts_min>0.0030994415283203125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39282065056649546</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39282065056649546</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>903</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>903</min_tcp_pkts><max_tcp_pkts>903</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1300"><ip.session_id>651</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5457160472869873</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.025033950805664062</time_between_pkts_sum><time_between_pkts_avg>0.025033950805664062</time_between_pkts_avg><time_between_pkts_max>0.025033950805664062</time_between_pkts_max><time_between_pkts_min>0.025033950805664062</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39281678766401185</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39281678766401185</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1301"><ip.session_id>651</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.545722007751465</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3928158679365232</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3928158679365232</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>50636</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>50636</min_tcp_pkts><max_tcp_pkts>50636</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1302"><ip.session_id>652</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5457370281219482</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.015020370483398438</time_between_pkts_sum><time_between_pkts_avg>0.015020370483398438</time_between_pkts_avg><time_between_pkts_max>0.015020370483398438</time_between_pkts_max><time_between_pkts_min>0.015020370483398438</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39281355024235326</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39281355024235326</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1303"><ip.session_id>652</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.545743942260742</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3928124833764515</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3928124833764515</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>5901</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>5901</min_tcp_pkts><max_tcp_pkts>5901</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1304"><ip.session_id>653</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5457370281219482</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39281355024235326</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39281355024235326</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1305"><ip.session_id>653</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5457499027252197</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39281156366911857</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39281156366911857</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>8085</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>8085</min_tcp_pkts><max_tcp_pkts>8085</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1306"><ip.session_id>654</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.545754909515381</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39281079111828704</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39281079111828704</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1307"><ip.session_id>654</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5457611083984375</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.006198883056640625</time_between_pkts_sum><time_between_pkts_avg>0.006198883056640625</time_between_pkts_avg><time_between_pkts_max>0.006198883056640625</time_between_pkts_max><time_between_pkts_min>0.006198883056640625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39280983463099156</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39280983463099156</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40911</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40911</min_tcp_pkts><max_tcp_pkts>40911</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1308"><ip.session_id>655</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.545754909515381</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39281079111828704</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39281079111828704</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1309"><ip.session_id>655</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5457661151885986</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3928090620869611</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3928090620869611</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>2030</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>2030</min_tcp_pkts><max_tcp_pkts>2030</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1310"><ip.session_id>656</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.545773983001709</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.007867813110351562</time_between_pkts_sum><time_between_pkts_avg>0.007867813110351562</time_between_pkts_avg><time_between_pkts_max>0.007867813110351562</time_between_pkts_max><time_between_pkts_min>0.007867813110351562</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3928078480953384</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3928078480953384</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1311"><ip.session_id>656</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.54577898979187</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39280707555912187</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39280707555912187</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>667</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>667</min_tcp_pkts><max_tcp_pkts>667</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1312"><ip.session_id>657</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5457940101623535</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.015020370483398438</time_between_pkts_sum><time_between_pkts_avg>0.015020370483398438</time_between_pkts_avg><time_between_pkts_max>0.015020370483398438</time_between_pkts_max><time_between_pkts_min>0.015020370483398438</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3928047579687041</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3928047579687041</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1313"><ip.session_id>657</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5458009243011475</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39280369115056074</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39280369115056074</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1039</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1039</min_tcp_pkts><max_tcp_pkts>1039</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1314"><ip.session_id>658</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.545804977416992</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0040531158447265625</time_between_pkts_sum><time_between_pkts_avg>0.0040531158447265625</time_between_pkts_avg><time_between_pkts_max>0.0040531158447265625</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39280306577710183</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39280306577710183</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1315"><ip.session_id>658</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5458099842071533</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3928022932596959</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3928022932596959</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>55055</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>55055</min_tcp_pkts><max_tcp_pkts>55055</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1316"><ip.session_id>659</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5458340644836426</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.024080276489257812</time_between_pkts_sum><time_between_pkts_avg>0.024080276489257812</time_between_pkts_avg><time_between_pkts_max>0.024080276489257812</time_between_pkts_max><time_between_pkts_min>0.024080276489257812</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.392798577861289</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.392798577861289</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1317"><ip.session_id>659</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.545841932296753</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.007867813110351562</time_between_pkts_sum><time_between_pkts_avg>0.007867813110351562</time_between_pkts_avg><time_between_pkts_max>0.007867813110351562</time_between_pkts_max><time_between_pkts_min>0.007867813110351562</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39279736393446923</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39279736393446923</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>8099</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>8099</min_tcp_pkts><max_tcp_pkts>8099</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1318"><ip.session_id>660</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5458340644836426</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.392798577861289</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.392798577861289</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1319"><ip.session_id>660</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5458478927612305</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39279644429793426</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39279644429793426</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>58080</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>58080</min_tcp_pkts><max_tcp_pkts>58080</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1320"><ip.session_id>661</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5458340644836426</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.392798577861289</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.392798577861289</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1321"><ip.session_id>661</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.545851945877075</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0040531158447265625</time_between_pkts_sum><time_between_pkts_avg>0.0040531158447265625</time_between_pkts_avg><time_between_pkts_max>0.0040531158447265625</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3927958189475502</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3927958189475502</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>901</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>901</min_tcp_pkts><max_tcp_pkts>901</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1322"><ip.session_id>662</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.545896053314209</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.04410743713378906</time_between_pkts_sum><time_between_pkts_avg>0.04410743713378906</time_between_pkts_avg><time_between_pkts_max>0.04410743713378906</time_between_pkts_max><time_between_pkts_min>0.04410743713378906</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.392789013792694</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.392789013792694</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1323"><ip.session_id>662</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.54590106010437</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3927882413305585</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3927882413305585</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1310</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1310</min_tcp_pkts><max_tcp_pkts>1310</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1324"><ip.session_id>663</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5459671020507812</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.06604194641113281</time_between_pkts_sum><time_between_pkts_avg>0.06604194641113281</time_between_pkts_avg><time_between_pkts_max>0.06604194641113281</time_between_pkts_max><time_between_pkts_min>0.06604194641113281</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3927780524714943</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3927780524714943</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1325"><ip.session_id>663</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5459821224212646</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.015020370483398438</time_between_pkts_sum><time_between_pkts_avg>0.015020370483398438</time_between_pkts_avg><time_between_pkts_max>0.015020370483398438</time_between_pkts_max><time_between_pkts_min>0.015020370483398438</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3927757352235396</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3927757352235396</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>2968</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>2968</min_tcp_pkts><max_tcp_pkts>2968</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1326"><ip.session_id>664</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5459671020507812</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3927780524714943</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3927780524714943</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1327"><ip.session_id>664</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.545988082885742</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39277481568827816</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39277481568827816</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>27352</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>27352</min_tcp_pkts><max_tcp_pkts>27352</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1328"><ip.session_id>665</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5459671020507812</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3927780524714943</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3927780524714943</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1329"><ip.session_id>665</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.545991897583008</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.003814697265625</time_between_pkts_sum><time_between_pkts_avg>0.003814697265625</time_between_pkts_avg><time_between_pkts_max>0.003814697265625</time_between_pkts_max><time_between_pkts_min>0.003814697265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39277422718797034</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39277422718797034</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>51493</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>51493</min_tcp_pkts><max_tcp_pkts>51493</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1330"><ip.session_id>666</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5459671020507812</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3927780524714943</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3927780524714943</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1331"><ip.session_id>666</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.545994997024536</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0030994415283203125</time_between_pkts_sum><time_between_pkts_avg>0.0030994415283203125</time_between_pkts_avg><time_between_pkts_max>0.0030994415283203125</time_between_pkts_max><time_between_pkts_min>0.0030994415283203125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39277374903276874</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39277374903276874</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>5925</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>5925</min_tcp_pkts><max_tcp_pkts>5925</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1332"><ip.session_id>667</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5459671020507812</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3927780524714943</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3927780524714943</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1333"><ip.session_id>667</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5459980964660645</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0030994415283203125</time_between_pkts_sum><time_between_pkts_avg>0.0030994415283203125</time_between_pkts_avg><time_between_pkts_max>0.0030994415283203125</time_between_pkts_max><time_between_pkts_min>0.0030994415283203125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3927732708787314</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3927732708787314</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>56737</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>56737</min_tcp_pkts><max_tcp_pkts>56737</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1334"><ip.session_id>668</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5459671020507812</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3927780524714943</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3927780524714943</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1335"><ip.session_id>668</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.546004056930542</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39277235135500854</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39277235135500854</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>5815</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>5815</min_tcp_pkts><max_tcp_pkts>5815</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1336"><ip.session_id>669</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.546005964279175</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0019073486328125</time_between_pkts_sum><time_between_pkts_avg>0.0019073486328125</time_between_pkts_avg><time_between_pkts_max>0.0019073486328125</time_between_pkts_max><time_between_pkts_min>0.0019073486328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3927720571083265</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3927720571083265</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1337"><ip.session_id>669</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5460119247436523</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3927711375902868</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3927711375902868</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1217</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1217</min_tcp_pkts><max_tcp_pkts>1217</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1338"><ip.session_id>670</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.546005964279175</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3927720571083265</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3927720571083265</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1339"><ip.session_id>670</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.546018123626709</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.006198883056640625</time_between_pkts_sum><time_between_pkts_avg>0.006198883056640625</time_between_pkts_avg><time_between_pkts_max>0.006198883056640625</time_between_pkts_max><time_between_pkts_min>0.006198883056640625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3927701812960926</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3927701812960926</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1063</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1063</min_tcp_pkts><max_tcp_pkts>1063</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1340"><ip.session_id>671</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5460309982299805</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.012874603271484375</time_between_pkts_sum><time_between_pkts_avg>0.012874603271484375</time_between_pkts_avg><time_between_pkts_max>0.012874603271484375</time_between_pkts_max><time_between_pkts_min>0.012874603271484375</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39276819516149153</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39276819516149153</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1341"><ip.session_id>671</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5460360050201416</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39276742278123794</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39276742278123794</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>16113</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>16113</min_tcp_pkts><max_tcp_pkts>16113</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1342"><ip.session_id>672</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5484800338745117</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>2.444028854370117</time_between_pkts_sum><time_between_pkts_avg>2.444028854370117</time_between_pkts_avg><time_between_pkts_max>2.444028854370117</time_between_pkts_max><time_between_pkts_min>2.444028854370117</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3923907531971822</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3923907531971822</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1343"><ip.session_id>672</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5484859943389893</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3923898354636137</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3923898354636137</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>8180</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>8180</min_tcp_pkts><max_tcp_pkts>8180</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1344"><ip.session_id>673</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.549345016479492</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.8590221405029297</time_between_pkts_sum><time_between_pkts_avg>0.8590221405029297</time_between_pkts_avg><time_between_pkts_max>0.8590221405029297</time_between_pkts_max><time_between_pkts_min>0.8590221405029297</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39225761657829505</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39225761657829505</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1345"><ip.session_id>673</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5493500232696533</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.392256846204844</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.392256846204844</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>7937</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>7937</min_tcp_pkts><max_tcp_pkts>7937</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1346"><ip.session_id>674</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.554063081741333</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>4.7130584716796875</time_between_pkts_sum><time_between_pkts_avg>4.7130584716796875</time_between_pkts_avg><time_between_pkts_max>4.7130584716796875</time_between_pkts_max><time_between_pkts_min>4.7130584716796875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3915330076022283</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3915330076022283</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1347"><ip.session_id>674</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5540730953216553</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.010013580322265625</time_between_pkts_sum><time_between_pkts_avg>0.010013580322265625</time_between_pkts_avg><time_between_pkts_max>0.010013580322265625</time_between_pkts_max><time_between_pkts_min>0.010013580322265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39153147254544873</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39153147254544873</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>8600</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>8600</min_tcp_pkts><max_tcp_pkts>8600</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1348"><ip.session_id>675</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.554080009460449</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3915304126323163</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3915304126323163</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1349"><ip.session_id>675</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.554086923599243</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3915293527249224</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3915293527249224</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>10629</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>10629</min_tcp_pkts><max_tcp_pkts>10629</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1350"><ip.session_id>676</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.554080009460449</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3915304126323163</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3915304126323163</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1351"><ip.session_id>676</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5540969371795654</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.010013580322265625</time_between_pkts_sum><time_between_pkts_avg>0.010013580322265625</time_between_pkts_avg><time_between_pkts_max>0.010013580322265625</time_between_pkts_max><time_between_pkts_min>0.010013580322265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3915278176968015</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3915278176968015</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>280</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>280</min_tcp_pkts><max_tcp_pkts>280</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1352"><ip.session_id>677</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.554111957550049</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.015020370483398438</time_between_pkts_sum><time_between_pkts_avg>0.015020370483398438</time_between_pkts_avg><time_between_pkts_max>0.015020370483398438</time_between_pkts_max><time_between_pkts_min>0.015020370483398438</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39152551517718837</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39152551517718837</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1353"><ip.session_id>677</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5541179180145264</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3915246014864348</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3915246014864348</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>25734</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>25734</min_tcp_pkts><max_tcp_pkts>25734</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1354"><ip.session_id>678</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.554124116897583</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.006198883056640625</time_between_pkts_sum><time_between_pkts_avg>0.006198883056640625</time_between_pkts_avg><time_between_pkts_max>0.006198883056640625</time_between_pkts_max><time_between_pkts_min>0.006198883056640625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3915236512525748</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3915236512525748</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1355"><ip.session_id>678</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5541329383850098</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.007867813110351562</time_between_pkts_sum><time_between_pkts_avg>0.007867813110351562</time_between_pkts_avg><time_between_pkts_max>0.007867813110351562</time_between_pkts_max><time_between_pkts_min>0.007867813110351562</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3915222990046496</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3915222990046496</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>5800</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>5800</min_tcp_pkts><max_tcp_pkts>5800</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1356"><ip.session_id>679</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5541250705718994</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.00095367431640625</time_between_pkts_sum><time_between_pkts_avg>0.00095367431640625</time_between_pkts_avg><time_between_pkts_max>0.00095367431640625</time_between_pkts_max><time_between_pkts_min>0.00095367431640625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39152350506315964</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39152350506315964</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1357"><ip.session_id>679</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.554141044616699</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.008106231689453125</time_between_pkts_sum><time_between_pkts_avg>0.008106231689453125</time_between_pkts_avg><time_between_pkts_max>0.008106231689453125</time_between_pkts_max><time_between_pkts_min>0.008106231689453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39152105640668344</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39152105640668344</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>5054</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>5054</min_tcp_pkts><max_tcp_pkts>5054</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1358"><ip.session_id>680</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5541470050811768</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3915201427367403</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3915201427367403</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1359"><ip.session_id>680</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5541560649871826</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.009059906005859375</time_between_pkts_sum><time_between_pkts_avg>0.009059906005859375</time_between_pkts_avg><time_between_pkts_max>0.009059906005859375</time_between_pkts_max><time_between_pkts_min>0.009059906005859375</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39151875396659375</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39151875396659375</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>2022</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>2022</min_tcp_pkts><max_tcp_pkts>2022</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1360"><ip.session_id>681</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5541470050811768</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3915201427367403</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3915201427367403</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1361"><ip.session_id>681</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.55416202545166</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3915178403073967</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3915178403073967</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>5877</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>5877</min_tcp_pkts><max_tcp_pkts>5877</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1362"><ip.session_id>682</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.554166078567505</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0040531158447265625</time_between_pkts_sum><time_between_pkts_avg>0.0040531158447265625</time_between_pkts_avg><time_between_pkts_max>0.0040531158447265625</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3915172190215785</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3915172190215785</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1363"><ip.session_id>682</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.554172992706299</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3915161591856158</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3915161591856158</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>8500</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>8500</min_tcp_pkts><max_tcp_pkts>8500</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1364"><ip.session_id>683</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.554166078567505</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3915172190215785</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3915172190215785</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1365"><ip.session_id>683</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.55417799949646</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3915153917217765</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3915153917217765</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>9011</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>9011</min_tcp_pkts><max_tcp_pkts>9011</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1366"><ip.session_id>684</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.554183006286621</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.391514624260946</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.391514624260946</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1367"><ip.session_id>684</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.554187059402466</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0040531158447265625</time_between_pkts_sum><time_between_pkts_avg>0.0040531158447265625</time_between_pkts_avg><time_between_pkts_max>0.0040531158447265625</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3915140029853346</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3915140029853346</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>10004</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>10004</min_tcp_pkts><max_tcp_pkts>10004</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1368"><ip.session_id>685</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.554450035095215</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.26297569274902344</time_between_pkts_sum><time_between_pkts_avg>0.26297569274902344</time_between_pkts_avg><time_between_pkts_max>0.26297569274902344</time_between_pkts_max><time_between_pkts_min>0.26297569274902344</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39147369737561766</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39147369737561766</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1369"><ip.session_id>685</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.554455041885376</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39147293007823947</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39147293007823947</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1091</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1091</min_tcp_pkts><max_tcp_pkts>1091</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1370"><ip.session_id>686</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.554543972015381</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.08893013000488281</time_between_pkts_sum><time_between_pkts_avg>0.08893013000488281</time_between_pkts_avg><time_between_pkts_max>0.08893013000488281</time_between_pkts_max><time_between_pkts_min>0.08893013000488281</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39145930191644357</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39145930191644357</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1371"><ip.session_id>686</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.554548978805542</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39145853467549513</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39145853467549513</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>32773</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>32773</min_tcp_pkts><max_tcp_pkts>32773</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1372"><ip.session_id>687</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5545549392700195</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.391457621297335</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.391457621297335</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1373"><ip.session_id>687</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5545589923858643</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0040531158447265625</time_between_pkts_sum><time_between_pkts_avg>0.0040531158447265625</time_between_pkts_avg><time_between_pkts_max>0.0040531158447265625</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39145700020262075</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39145700020262075</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>19350</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>19350</min_tcp_pkts><max_tcp_pkts>19350</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1374"><ip.session_id>688</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5545899868011475</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.030994415283203125</time_between_pkts_sum><time_between_pkts_avg>0.030994415283203125</time_between_pkts_avg><time_between_pkts_max>0.030994415283203125</time_between_pkts_max><time_between_pkts_min>0.030994415283203125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39145225071996703</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39145225071996703</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1375"><ip.session_id>688</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.554595947265625</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3914513373711309</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3914513373711309</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1069</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1069</min_tcp_pkts><max_tcp_pkts>1069</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1376"><ip.session_id>689</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.554600954055786</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3914505701614024</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3914505701614024</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1377"><ip.session_id>689</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.554605007171631</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0040531158447265625</time_between_pkts_sum><time_between_pkts_avg>0.0040531158447265625</time_between_pkts_avg><time_between_pkts_max>0.0040531158447265625</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3914499490890629</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3914499490890629</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>10001</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>10001</min_tcp_pkts><max_tcp_pkts>10001</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1378"><ip.session_id>690</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.554624080657959</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.019073486328125</time_between_pkts_sum><time_between_pkts_avg>0.019073486328125</time_between_pkts_avg><time_between_pkts_max>0.019073486328125</time_between_pkts_max><time_between_pkts_min>0.019073486328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3914470264221591</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3914470264221591</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1379"><ip.session_id>690</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5546319484710693</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.007867813110351562</time_between_pkts_sum><time_between_pkts_avg>0.007867813110351562</time_between_pkts_avg><time_between_pkts_max>0.007867813110351562</time_between_pkts_max><time_between_pkts_min>0.007867813110351562</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39144582083477564</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39144582083477564</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>49</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>49</min_tcp_pkts><max_tcp_pkts>49</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1380"><ip.session_id>691</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.554624080657959</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3914470264221591</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3914470264221591</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1381"><ip.session_id>691</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5546369552612305</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39144505364667076</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39144505364667076</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>9207</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>9207</min_tcp_pkts><max_tcp_pkts>9207</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1382"><ip.session_id>692</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.554641008377075</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0040531158447265625</time_between_pkts_sum><time_between_pkts_avg>0.0040531158447265625</time_between_pkts_avg><time_between_pkts_max>0.0040531158447265625</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39144443259183603</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39144443259183603</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1383"><ip.session_id>692</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5546460151672363</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3914436654091727</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3914436654091727</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1783</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1783</min_tcp_pkts><max_tcp_pkts>1783</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1384"><ip.session_id>693</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.554737091064453</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.09107589721679688</time_between_pkts_sum><time_between_pkts_avg>0.09107589721679688</time_between_pkts_avg><time_between_pkts_max>0.09107589721679688</time_between_pkts_max><time_between_pkts_min>0.09107589721679688</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39142971051605996</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39142971051605996</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1385"><ip.session_id>693</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5547430515289307</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39142879727240376</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39142879727240376</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1050</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1050</min_tcp_pkts><max_tcp_pkts>1050</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1386"><ip.session_id>694</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.554764986038208</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.02193450927734375</time_between_pkts_sum><time_between_pkts_avg>0.02193450927734375</time_between_pkts_avg><time_between_pkts_max>0.02193450927734375</time_between_pkts_max><time_between_pkts_min>0.02193450927734375</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3914254365724443</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3914254365724443</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1387"><ip.session_id>694</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.554769992828369</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39142466946423876</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39142466946423876</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>3689</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>3689</min_tcp_pkts><max_tcp_pkts>3689</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1388"><ip.session_id>695</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.55479097366333</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0209808349609375</time_between_pkts_sum><time_between_pkts_avg>0.0209808349609375</time_between_pkts_avg><time_between_pkts_max>0.0209808349609375</time_between_pkts_max><time_between_pkts_min>0.0209808349609375</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39142145494826686</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39142145494826686</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1389"><ip.session_id>695</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.554798126220703</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.007152557373046875</time_between_pkts_sum><time_between_pkts_avg>0.007152557373046875</time_between_pkts_avg><time_between_pkts_max>0.007152557373046875</time_between_pkts_max><time_between_pkts_min>0.007152557373046875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39142035910261674</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39142035910261674</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>5962</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>5962</min_tcp_pkts><max_tcp_pkts>5962</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1390"><ip.session_id>696</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.55479097366333</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39142145494826686</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39142145494826686</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1391"><ip.session_id>696</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5548040866851807</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39141944590259553</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39141944590259553</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1095</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1095</min_tcp_pkts><max_tcp_pkts>1095</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1392"><ip.session_id>697</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.554809093475342</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3914186788178706</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3914186788178706</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1393"><ip.session_id>697</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5548129081726074</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.003814697265625</time_between_pkts_sum><time_between_pkts_avg>0.003814697265625</time_between_pkts_avg><time_between_pkts_max>0.003814697265625</time_between_pkts_max><time_between_pkts_min>0.003814697265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39141809437438396</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39141809437438396</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1503</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1503</min_tcp_pkts><max_tcp_pkts>1503</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1394"><ip.session_id>698</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5548319816589355</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.019073486328125</time_between_pkts_sum><time_between_pkts_avg>0.019073486328125</time_between_pkts_avg><time_between_pkts_max>0.019073486328125</time_between_pkts_max><time_between_pkts_min>0.019073486328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3914151721831302</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3914151721831302</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1395"><ip.session_id>698</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.554837942123413</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39141425900731136</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39141425900731136</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>3221</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>3221</min_tcp_pkts><max_tcp_pkts>3221</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1396"><ip.session_id>699</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.554866075515747</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.028133392333984375</time_between_pkts_sum><time_between_pkts_avg>0.028133392333984375</time_between_pkts_avg><time_between_pkts_max>0.028133392333984375</time_between_pkts_max><time_between_pkts_min>0.028133392333984375</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3914099488749646</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3914099488749646</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1397"><ip.session_id>699</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.554871082305908</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3914091818274628</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3914091818274628</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>5960</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>5960</min_tcp_pkts><max_tcp_pkts>5960</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1398"><ip.session_id>700</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.554892063140869</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0209808349609375</time_between_pkts_sum><time_between_pkts_avg>0.0209808349609375</time_between_pkts_avg><time_between_pkts_max>0.0209808349609375</time_between_pkts_max><time_between_pkts_min>0.0209808349609375</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39140596756586465</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39140596756586465</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1399"><ip.session_id>700</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5548980236053467</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39140505443299417</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39140505443299417</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>2004</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>2004</min_tcp_pkts><max_tcp_pkts>2004</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1400"><ip.session_id>701</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.555001974105835</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.10395050048828125</time_between_pkts_sum><time_between_pkts_avg>0.10395050048828125</time_between_pkts_avg><time_between_pkts_max>0.10395050048828125</time_between_pkts_max><time_between_pkts_min>0.10395050048828125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3913891300807963</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3913891300807963</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1401"><ip.session_id>701</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.555009126663208</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.007152557373046875</time_between_pkts_sum><time_between_pkts_avg>0.007152557373046875</time_between_pkts_avg><time_between_pkts_max>0.007152557373046875</time_between_pkts_max><time_between_pkts_min>0.007152557373046875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3913880344161355</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3913880344161355</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>62078</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>62078</min_tcp_pkts><max_tcp_pkts>62078</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1402"><ip.session_id>702</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.55501389503479</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.00476837158203125</time_between_pkts_sum><time_between_pkts_avg>0.00476837158203125</time_between_pkts_avg><time_between_pkts_max>0.00476837158203125</time_between_pkts_max><time_between_pkts_min>0.00476837158203125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39138730397643634</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39138730397643634</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1403"><ip.session_id>702</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5550200939178467</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.006198883056640625</time_between_pkts_sum><time_between_pkts_avg>0.006198883056640625</time_between_pkts_avg><time_between_pkts_max>0.006198883056640625</time_between_pkts_max><time_between_pkts_min>0.006198883056640625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3913863544089034</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3913863544089034</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1151</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1151</min_tcp_pkts><max_tcp_pkts>1151</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1404"><ip.session_id>703</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.55501389503479</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39138730397643634</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39138730397643634</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1405"><ip.session_id>703</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.555026054382324</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.39138544136754383</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.39138544136754383</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>749</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>749</min_tcp_pkts><max_tcp_pkts>749</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1406"><ip.session_id>704</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.579479932785034</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>24.45387840270996</time_between_pkts_sum><time_between_pkts_avg>24.45387840270996</time_between_pkts_avg><time_between_pkts_max>24.45387840270996</time_between_pkts_max><time_between_pkts_min>24.45387840270996</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3876750453802956</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3876750453802956</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1407"><ip.session_id>704</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.579500913619995</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0209808349609375</time_between_pkts_sum><time_between_pkts_avg>0.0209808349609375</time_between_pkts_avg><time_between_pkts_max>0.0209808349609375</time_between_pkts_max><time_between_pkts_min>0.0209808349609375</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38767189215553705</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38767189215553705</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>3809</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>3809</min_tcp_pkts><max_tcp_pkts>3809</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1408"><ip.session_id>705</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.579508066177368</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.007152557373046875</time_between_pkts_sum><time_between_pkts_avg>0.007152557373046875</time_between_pkts_avg><time_between_pkts_max>0.007152557373046875</time_between_pkts_max><time_between_pkts_min>0.007152557373046875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3876708172042752</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3876708172042752</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1409"><ip.session_id>705</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.579514980316162</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3876697780903887</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3876697780903887</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>513</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>513</min_tcp_pkts><max_tcp_pkts>513</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1410"><ip.session_id>706</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.579508066177368</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3876708172042752</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3876708172042752</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1411"><ip.session_id>706</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5795199871063232</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3876690256320862</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3876690256320862</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>687</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>687</min_tcp_pkts><max_tcp_pkts>687</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1412"><ip.session_id>707</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5795629024505615</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.04291534423828125</time_between_pkts_sum><time_between_pkts_avg>0.04291534423828125</time_between_pkts_avg><time_between_pkts_max>0.04291534423828125</time_between_pkts_max><time_between_pkts_min>0.04291534423828125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38766257610931254</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38766257610931254</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1413"><ip.session_id>707</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5795679092407227</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38766182367896757</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38766182367896757</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>2006</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>2006</min_tcp_pkts><max_tcp_pkts>2006</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1414"><ip.session_id>708</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5795741081237793</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.006198883056640625</time_between_pkts_sum><time_between_pkts_avg>0.006198883056640625</time_between_pkts_avg><time_between_pkts_max>0.006198883056640625</time_between_pkts_max><time_between_pkts_min>0.006198883056640625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3876608921025872</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3876608921025872</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1415"><ip.session_id>708</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5795791149139404</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38766013967877927</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38766013967877927</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>5910</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>5910</min_tcp_pkts><max_tcp_pkts>5910</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1416"><ip.session_id>709</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.579591989517212</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.012874603271484375</time_between_pkts_sum><time_between_pkts_avg>0.012874603271484375</time_between_pkts_avg><time_between_pkts_max>0.012874603271484375</time_between_pkts_max><time_between_pkts_min>0.012874603271484375</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38765820488811364</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38765820488811364</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1417"><ip.session_id>709</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.579596996307373</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3876574524747371</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3876574524747371</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>4279</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>4279</min_tcp_pkts><max_tcp_pkts>4279</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1418"><ip.session_id>710</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.579620122909546</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.023126602172851562</time_between_pkts_sum><time_between_pkts_avg>0.023126602172851562</time_between_pkts_avg><time_between_pkts_max>0.023126602172851562</time_between_pkts_max><time_between_pkts_min>0.023126602172851562</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3876539770794248</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3876539770794248</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1419"><ip.session_id>710</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5796239376068115</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.003814697265625</time_between_pkts_sum><time_between_pkts_avg>0.003814697265625</time_between_pkts_avg><time_between_pkts_max>0.003814697265625</time_between_pkts_max><time_between_pkts_min>0.003814697265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3876534038243294</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3876534038243294</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>23502</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>23502</min_tcp_pkts><max_tcp_pkts>23502</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1420"><ip.session_id>711</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.580054998397827</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.431060791015625</time_between_pkts_sum><time_between_pkts_avg>0.431060791015625</time_between_pkts_avg><time_between_pkts_max>0.431060791015625</time_between_pkts_max><time_between_pkts_min>0.431060791015625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38758863691703627</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38758863691703627</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1421"><ip.session_id>711</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5800609588623047</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38758774150861797</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38758774150861797</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1641</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1641</min_tcp_pkts><max_tcp_pkts>1641</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1422"><ip.session_id>712</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.58024001121521</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.17905235290527344</time_between_pkts_sum><time_between_pkts_avg>0.17905235290527344</time_between_pkts_avg><time_between_pkts_max>0.17905235290527344</time_between_pkts_max><time_between_pkts_min>0.17905235290527344</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38756084536842456</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38756084536842456</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1423"><ip.session_id>712</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5802578926086426</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.017881393432617188</time_between_pkts_sum><time_between_pkts_avg>0.017881393432617188</time_between_pkts_avg><time_between_pkts_max>0.017881393432617188</time_between_pkts_max><time_between_pkts_min>0.017881393432617188</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38755815954078887</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38755815954078887</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>8400</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>8400</min_tcp_pkts><max_tcp_pkts>8400</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1424"><ip.session_id>713</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.58024001121521</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38756084536842456</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38756084536842456</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1425"><ip.session_id>713</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5802690982818604</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.011205673217773438</time_between_pkts_sum><time_between_pkts_avg>0.011205673217773438</time_between_pkts_avg><time_between_pkts_max>0.011205673217773438</time_between_pkts_max><time_between_pkts_min>0.011205673217773438</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3875564764411108</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3875564764411108</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>9618</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>9618</min_tcp_pkts><max_tcp_pkts>9618</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1426"><ip.session_id>714</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.580272912979126</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.003814697265625</time_between_pkts_sum><time_between_pkts_avg>0.003814697265625</time_between_pkts_avg><time_between_pkts_max>0.003814697265625</time_between_pkts_max><time_between_pkts_min>0.003814697265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.387555903474343</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.387555903474343</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1427"><ip.session_id>714</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.580277919769287</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3875551514580313</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3875551514580313</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>5631</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>5631</min_tcp_pkts><max_tcp_pkts>5631</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1428"><ip.session_id>715</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5803921222686768</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.11420249938964844</time_between_pkts_sum><time_between_pkts_avg>0.11420249938964844</time_between_pkts_avg><time_between_pkts_max>0.11420249938964844</time_between_pkts_max><time_between_pkts_min>0.11420249938964844</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.387537999116507</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.387537999116507</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1429"><ip.session_id>715</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.580397129058838</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3875372471696771</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3875372471696771</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>8082</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>8082</min_tcp_pkts><max_tcp_pkts>8082</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1430"><ip.session_id>716</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.58042311668396</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.025987625122070312</time_between_pkts_sum><time_between_pkts_avg>0.025987625122070312</time_between_pkts_avg><time_between_pkts_max>0.025987625122070312</time_between_pkts_max><time_between_pkts_min>0.025987625122070312</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38753334425443997</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38753334425443997</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1431"><ip.session_id>716</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5804290771484375</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3875324491014777</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3875324491014777</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>5009</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>5009</min_tcp_pkts><max_tcp_pkts>5009</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1432"><ip.session_id>717</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5807080268859863</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.2789497375488281</time_between_pkts_sum><time_between_pkts_avg>0.2789497375488281</time_between_pkts_avg><time_between_pkts_max>0.2789497375488281</time_between_pkts_max><time_between_pkts_min>0.2789497375488281</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38749056056784964</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38749056056784964</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1433"><ip.session_id>717</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5807158946990967</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.007867813110351562</time_between_pkts_sum><time_between_pkts_avg>0.007867813110351562</time_between_pkts_avg><time_between_pkts_max>0.007867813110351562</time_between_pkts_max><time_between_pkts_min>0.007867813110351562</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3874893792276956</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3874893792276956</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>19842</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>19842</min_tcp_pkts><max_tcp_pkts>19842</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1434"><ip.session_id>718</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5807080268859863</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38749056056784964</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38749056056784964</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1435"><ip.session_id>718</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.580720901489258</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3874886274695297</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3874886274695297</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>5987</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>5987</min_tcp_pkts><max_tcp_pkts>5987</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1436"><ip.session_id>719</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5807230472564697</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0021457672119140625</time_between_pkts_sum><time_between_pkts_avg>0.0021457672119140625</time_between_pkts_avg><time_between_pkts_max>0.0021457672119140625</time_between_pkts_max><time_between_pkts_min>0.0021457672119140625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3874883052883516</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3874883052883516</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1437"><ip.session_id>719</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.580728054046631</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3874875535343528</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3874875535343528</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>7200</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>7200</min_tcp_pkts><max_tcp_pkts>7200</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1438"><ip.session_id>720</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5807549953460693</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.026941299438476562</time_between_pkts_sum><time_between_pkts_avg>0.026941299438476562</time_between_pkts_avg><time_between_pkts_max>0.026941299438476562</time_between_pkts_max><time_between_pkts_min>0.026941299438476562</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3874835084319594</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3874835084319594</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1439"><ip.session_id>720</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5807669162750244</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.011920928955078125</time_between_pkts_sum><time_between_pkts_avg>0.011920928955078125</time_between_pkts_avg><time_between_pkts_max>0.011920928955078125</time_between_pkts_max><time_between_pkts_min>0.011920928955078125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38748171859059627</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38748171859059627</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>24444</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>24444</min_tcp_pkts><max_tcp_pkts>24444</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1440"><ip.session_id>721</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5807549953460693</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3874835084319594</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3874835084319594</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1441"><ip.session_id>721</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.580773115158081</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.006198883056640625</time_between_pkts_sum><time_between_pkts_avg>0.006198883056640625</time_between_pkts_avg><time_between_pkts_max>0.006198883056640625</time_between_pkts_max><time_between_pkts_min>0.006198883056640625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38748078787962215</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38748078787962215</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1028</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1028</min_tcp_pkts><max_tcp_pkts>1028</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1442"><ip.session_id>722</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5807549953460693</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3874835084319594</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3874835084319594</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1443"><ip.session_id>722</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.580775022506714</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0019073486328125</time_between_pkts_sum><time_between_pkts_avg>0.0019073486328125</time_between_pkts_avg><time_between_pkts_max>0.0019073486328125</time_between_pkts_max><time_between_pkts_min>0.0019073486328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3874805015079142</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3874805015079142</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>32772</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>32772</min_tcp_pkts><max_tcp_pkts>32772</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1444"><ip.session_id>723</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5807549953460693</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3874835084319594</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3874835084319594</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1445"><ip.session_id>723</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.580780029296875</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3874797497841948</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3874797497841948</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>700</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>700</min_tcp_pkts><max_tcp_pkts>700</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1446"><ip.session_id>724</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5807549953460693</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3874835084319594</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3874835084319594</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1447"><ip.session_id>724</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5807831287384033</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0030994415283203125</time_between_pkts_sum><time_between_pkts_avg>0.0030994415283203125</time_between_pkts_avg><time_between_pkts_max>0.0030994415283203125</time_between_pkts_max><time_between_pkts_min>0.0030994415283203125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38747928443287777</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38747928443287777</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1801</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1801</min_tcp_pkts><max_tcp_pkts>1801</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1448"><ip.session_id>725</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5807859897613525</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.00286102294921875</time_between_pkts_sum><time_between_pkts_avg>0.00286102294921875</time_between_pkts_avg><time_between_pkts_max>0.00286102294921875</time_between_pkts_max><time_between_pkts_min>0.00286102294921875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.387478854878808</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.387478854878808</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1449"><ip.session_id>725</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5807950496673584</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.008106231689453125</time_between_pkts_sum><time_between_pkts_avg>0.008106231689453125</time_between_pkts_avg><time_between_pkts_max>0.008106231689453125</time_between_pkts_max><time_between_pkts_min>0.008106231689453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3874774946305369</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3874774946305369</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>2717</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>2717</min_tcp_pkts><max_tcp_pkts>2717</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1450"><ip.session_id>726</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5807859897613525</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.387478854878808</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.387478854878808</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1451"><ip.session_id>726</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.580801010131836</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38747659973556686</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38747659973556686</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>27000</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>27000</min_tcp_pkts><max_tcp_pkts>27000</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1452"><ip.session_id>727</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5807859897613525</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.387478854878808</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.387478854878808</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1453"><ip.session_id>727</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5808041095733643</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0030994415283203125</time_between_pkts_sum><time_between_pkts_avg>0.0030994415283203125</time_between_pkts_avg><time_between_pkts_max>0.0030994415283203125</time_between_pkts_max><time_between_pkts_min>0.0030994415283203125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38747613439181605</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38747613439181605</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>10002</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>10002</min_tcp_pkts><max_tcp_pkts>10002</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1454"><ip.session_id>728</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.580786943435669</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.00095367431640625</time_between_pkts_sum><time_between_pkts_avg>0.00095367431640625</time_between_pkts_avg><time_between_pkts_max>0.00095367431640625</time_between_pkts_max><time_between_pkts_min>0.00095367431640625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38747871169432974</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38747871169432974</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1455"><ip.session_id>728</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.580811023712158</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3874750963213227</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3874750963213227</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>18988</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>18988</min_tcp_pkts><max_tcp_pkts>18988</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1456"><ip.session_id>729</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.580815076828003</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0040531158447265625</time_between_pkts_sum><time_between_pkts_avg>0.0040531158447265625</time_between_pkts_avg><time_between_pkts_max>0.0040531158447265625</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3874744877998264</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3874744877998264</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1457"><ip.session_id>729</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5808191299438477</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0040531158447265625</time_between_pkts_sum><time_between_pkts_avg>0.0040531158447265625</time_between_pkts_avg><time_between_pkts_max>0.0040531158447265625</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38747387928024135</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38747387928024135</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>3005</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>3005</min_tcp_pkts><max_tcp_pkts>3005</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1458"><ip.session_id>730</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.580838918685913</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.019788742065429688</time_between_pkts_sum><time_between_pkts_avg>0.019788742065429688</time_between_pkts_avg><time_between_pkts_max>0.019788742065429688</time_between_pkts_max><time_between_pkts_min>0.019788742065429688</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.387470908300302</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.387470908300302</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1459"><ip.session_id>730</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5808489322662354</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.010013580322265625</time_between_pkts_sum><time_between_pkts_avg>0.010013580322265625</time_between_pkts_avg><time_between_pkts_max>0.010013580322265625</time_between_pkts_max><time_between_pkts_min>0.010013580322265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38746940493022314</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38746940493022314</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>14000</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>14000</min_tcp_pkts><max_tcp_pkts>14000</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1460"><ip.session_id>731</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.580838918685913</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.387470908300302</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.387470908300302</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1461"><ip.session_id>731</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.580854892730713</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3874685100726197</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3874685100726197</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1169</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1169</min_tcp_pkts><max_tcp_pkts>1169</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1462"><ip.session_id>732</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.580838918685913</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.387470908300302</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.387470908300302</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1463"><ip.session_id>732</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5808589458465576</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0040531158447265625</time_between_pkts_sum><time_between_pkts_avg>0.0040531158447265625</time_between_pkts_avg><time_between_pkts_max>0.0040531158447265625</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38746790157181027</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38746790157181027</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>9503</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>9503</min_tcp_pkts><max_tcp_pkts>9503</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1464"><ip.session_id>733</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5808639526367188</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3874671498969785</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3874671498969785</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1465"><ip.session_id>733</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.580872058868408</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.008106231689453125</time_between_pkts_sum><time_between_pkts_avg>0.008106231689453125</time_between_pkts_avg><time_between_pkts_max>0.008106231689453125</time_between_pkts_max><time_between_pkts_min>0.008106231689453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38746593290581527</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38746593290581527</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1247</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1247</min_tcp_pkts><max_tcp_pkts>1247</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1466"><ip.session_id>734</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5808639526367188</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3874671498969785</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3874671498969785</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1467"><ip.session_id>734</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5808780193328857</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3874650380642489</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3874650380642489</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>61532</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>61532</min_tcp_pkts><max_tcp_pkts>61532</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1468"><ip.session_id>735</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5808639526367188</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3874671498969785</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3874671498969785</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1469"><ip.session_id>735</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.580883026123047</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3874642864005274</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3874642864005274</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>2170</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>2170</min_tcp_pkts><max_tcp_pkts>2170</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1470"><ip.session_id>736</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5808870792388916</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0040531158447265625</time_between_pkts_sum><time_between_pkts_avg>0.0040531158447265625</time_between_pkts_avg><time_between_pkts_max>0.0040531158447265625</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38746367791298403</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38746367791298403</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1471"><ip.session_id>736</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.580897092819214</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.010013580322265625</time_between_pkts_sum><time_between_pkts_avg>0.010013580322265625</time_between_pkts_avg><time_between_pkts_max>0.010013580322265625</time_between_pkts_max><time_between_pkts_min>0.010013580322265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3874621745990117</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3874621745990117</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>2401</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>2401</min_tcp_pkts><max_tcp_pkts>2401</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1472"><ip.session_id>737</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5808870792388916</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38746367791298403</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38746367791298403</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1473"><ip.session_id>737</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5809030532836914</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3874612797748047</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3874612797748047</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1174</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1174</min_tcp_pkts><max_tcp_pkts>1174</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1474"><ip.session_id>738</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5808870792388916</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38746367791298403</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38746367791298403</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1475"><ip.session_id>738</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.580907106399536</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0040531158447265625</time_between_pkts_sum><time_between_pkts_avg>0.0040531158447265625</time_between_pkts_avg><time_between_pkts_max>0.0040531158447265625</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38746067129670475</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38746067129670475</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1494</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1494</min_tcp_pkts><max_tcp_pkts>1494</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1476"><ip.session_id>739</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5808870792388916</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38746367791298403</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38746367791298403</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1477"><ip.session_id>739</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5809099674224854</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.00286102294921875</time_between_pkts_sum><time_between_pkts_avg>0.00286102294921875</time_between_pkts_avg><time_between_pkts_max>0.00286102294921875</time_between_pkts_max><time_between_pkts_min>0.00286102294921875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3874602417839025</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3874602417839025</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1166</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1166</min_tcp_pkts><max_tcp_pkts>1166</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1478"><ip.session_id>740</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5808870792388916</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38746367791298403</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38746367791298403</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1479"><ip.session_id>740</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5809149742126465</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3874594901387899</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3874594901387899</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>2492</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>2492</min_tcp_pkts><max_tcp_pkts>2492</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1480"><ip.session_id>741</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5810389518737793</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.1239776611328125</time_between_pkts_sum><time_between_pkts_avg>0.1239776611328125</time_between_pkts_avg><time_between_pkts_max>0.1239776611328125</time_between_pkts_max><time_between_pkts_min>0.1239776611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3874408789042185</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3874408789042185</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1481"><ip.session_id>741</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.581062078475952</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.023126602172851562</time_between_pkts_sum><time_between_pkts_avg>0.023126602172851562</time_between_pkts_avg><time_between_pkts_max>0.023126602172851562</time_between_pkts_max><time_between_pkts_min>0.023126602172851562</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3874374073910199</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3874374073910199</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1035</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1035</min_tcp_pkts><max_tcp_pkts>1035</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1482"><ip.session_id>742</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5810389518737793</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3874408789042185</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3874408789042185</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1483"><ip.session_id>742</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5810680389404297</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38743651268120627</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38743651268120627</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>18040</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>18040</min_tcp_pkts><max_tcp_pkts>18040</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1484"><ip.session_id>743</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5810389518737793</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3874408789042185</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3874408789042185</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1485"><ip.session_id>743</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.581073045730591</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3874357611281563</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3874357611281563</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>2106</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>2106</min_tcp_pkts><max_tcp_pkts>2106</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1486"><ip.session_id>744</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5810389518737793</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3874408789042185</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3874408789042185</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1487"><ip.session_id>744</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5810749530792236</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0019073486328125</time_between_pkts_sum><time_between_pkts_avg>0.0019073486328125</time_between_pkts_avg><time_between_pkts_max>0.0019073486328125</time_between_pkts_max><time_between_pkts_min>0.0019073486328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38743547482299945</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38743547482299945</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>9876</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>9876</min_tcp_pkts><max_tcp_pkts>9876</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1488"><ip.session_id>745</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5810389518737793</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3874408789042185</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3874408789042185</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1489"><ip.session_id>745</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5810821056365967</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.007152557373046875</time_between_pkts_sum><time_between_pkts_avg>0.007152557373046875</time_between_pkts_avg><time_between_pkts_max>0.007152557373046875</time_between_pkts_max><time_between_pkts_min>0.007152557373046875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38743440118242983</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38743440118242983</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>5802</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>5802</min_tcp_pkts><max_tcp_pkts>5802</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1490"><ip.session_id>746</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5810389518737793</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3874408789042185</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3874408789042185</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1491"><ip.session_id>746</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5810840129852295</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0019073486328125</time_between_pkts_sum><time_between_pkts_avg>0.0019073486328125</time_between_pkts_avg><time_between_pkts_max>0.0019073486328125</time_between_pkts_max><time_between_pkts_min>0.0019073486328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3874341148792829</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3874341148792829</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>3370</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>3370</min_tcp_pkts><max_tcp_pkts>3370</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1492"><ip.session_id>747</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5810890197753906</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38743336333553546</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38743336333553546</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1493"><ip.session_id>747</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5811009407043457</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.011920928955078125</time_between_pkts_sum><time_between_pkts_avg>0.011920928955078125</time_between_pkts_avg><time_between_pkts_max>0.011920928955078125</time_between_pkts_max><time_between_pkts_min>0.011920928955078125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38743157395739597</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38743157395739597</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>6969</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>6969</min_tcp_pkts><max_tcp_pkts>6969</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1494"><ip.session_id>748</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5810890197753906</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38743336333553546</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38743336333553546</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1495"><ip.session_id>748</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.581109046936035</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.008106231689453125</time_between_pkts_sum><time_between_pkts_avg>0.008106231689453125</time_between_pkts_avg><time_between_pkts_max>0.008106231689453125</time_between_pkts_max><time_between_pkts_min>0.008106231689453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38743035718970226</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38743035718970226</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>5120</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>5120</min_tcp_pkts><max_tcp_pkts>5120</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1496"><ip.session_id>749</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5810890197753906</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38743336333553546</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38743336333553546</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1497"><ip.session_id>749</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.58111310005188</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0040531158447265625</time_between_pkts_sum><time_between_pkts_avg>0.0040531158447265625</time_between_pkts_avg><time_between_pkts_max>0.0040531158447265625</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3874297488087214</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3874297488087214</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>4321</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>4321</min_tcp_pkts><max_tcp_pkts>4321</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1498"><ip.session_id>750</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5810890197753906</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38743336333553546</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38743336333553546</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1499"><ip.session_id>750</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.581115961074829</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.00286102294921875</time_between_pkts_sum><time_between_pkts_avg>0.00286102294921875</time_between_pkts_avg><time_between_pkts_max>0.00286102294921875</time_between_pkts_max><time_between_pkts_min>0.00286102294921875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38742931936447356</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38742931936447356</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1433</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1433</min_tcp_pkts><max_tcp_pkts>1433</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1500"><ip.session_id>751</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5810890197753906</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38743336333553546</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38743336333553546</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1501"><ip.session_id>751</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5811209678649902</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3874285678393306</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3874285678393306</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1521</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1521</min_tcp_pkts><max_tcp_pkts>1521</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1502"><ip.session_id>752</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5810890197753906</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38743336333553546</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38743336333553546</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1503"><ip.session_id>752</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.581123113632202</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0021457672119140625</time_between_pkts_sum><time_between_pkts_avg>0.0021457672119140625</time_between_pkts_avg><time_between_pkts_max>0.0021457672119140625</time_between_pkts_max><time_between_pkts_min>0.0021457672119140625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.387428245758019</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.387428245758019</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>49158</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>49158</min_tcp_pkts><max_tcp_pkts>49158</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1504"><ip.session_id>753</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5810890197753906</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38743336333553546</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38743336333553546</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1505"><ip.session_id>753</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5811259746551514</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.00286102294921875</time_between_pkts_sum><time_between_pkts_avg>0.00286102294921875</time_between_pkts_avg><time_between_pkts_max>0.00286102294921875</time_between_pkts_max><time_between_pkts_min>0.00286102294921875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3874278163171032</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3874278163171032</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>5060</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>5060</min_tcp_pkts><max_tcp_pkts>5060</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1506"><ip.session_id>754</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5838489532470703</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>2.7229785919189453</time_between_pkts_sum><time_between_pkts_avg>2.7229785919189453</time_between_pkts_avg><time_between_pkts_max>2.7229785919189453</time_between_pkts_max><time_between_pkts_min>2.7229785919189453</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3870195271063815</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3870195271063815</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1507"><ip.session_id>754</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.583858013153076</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.009059906005859375</time_between_pkts_sum><time_between_pkts_avg>0.009059906005859375</time_between_pkts_avg><time_between_pkts_max>0.009059906005859375</time_between_pkts_max><time_between_pkts_min>0.009059906005859375</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3870181700811424</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3870181700811424</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>3333</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>3333</min_tcp_pkts><max_tcp_pkts>3333</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1508"><ip.session_id>755</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.583889961242676</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.031948089599609375</time_between_pkts_sum><time_between_pkts_avg>0.031948089599609375</time_between_pkts_avg><time_between_pkts_max>0.031948089599609375</time_between_pkts_max><time_between_pkts_min>0.031948089599609375</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.387013384857561</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.387013384857561</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1509"><ip.session_id>755</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5838980674743652</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.008106231689453125</time_between_pkts_sum><time_between_pkts_avg>0.008106231689453125</time_between_pkts_avg><time_between_pkts_max>0.008106231689453125</time_between_pkts_max><time_between_pkts_min>0.008106231689453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3870121707151751</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3870121707151751</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1026</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1026</min_tcp_pkts><max_tcp_pkts>1026</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1510"><ip.session_id>756</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5839250087738037</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.026941299438476562</time_between_pkts_sum><time_between_pkts_avg>0.026941299438476562</time_between_pkts_avg><time_between_pkts_max>0.026941299438476562</time_between_pkts_max><time_between_pkts_min>0.026941299438476562</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3870081355319781</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3870081355319781</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1511"><ip.session_id>756</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.583933115005493</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.008106231689453125</time_between_pkts_sum><time_between_pkts_avg>0.008106231689453125</time_between_pkts_avg><time_between_pkts_max>0.008106231689453125</time_between_pkts_max><time_between_pkts_min>0.008106231689453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3870069214225284</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3870069214225284</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1000</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1000</min_tcp_pkts><max_tcp_pkts>1000</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1512"><ip.session_id>757</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5897529125213623</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>5.819797515869141</time_between_pkts_sum><time_between_pkts_avg>5.819797515869141</time_between_pkts_avg><time_between_pkts_max>5.819797515869141</time_between_pkts_max><time_between_pkts_min>5.819797515869141</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3861372238119845</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3861372238119845</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1513"><ip.session_id>757</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5897629261016846</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.010013580322265625</time_between_pkts_sum><time_between_pkts_avg>0.010013580322265625</time_between_pkts_avg><time_between_pkts_max>0.010013580322265625</time_between_pkts_max><time_between_pkts_min>0.010013580322265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3861357307733488</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3861357307733488</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1064</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1064</min_tcp_pkts><max_tcp_pkts>1064</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1514"><ip.session_id>758</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5897529125213623</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3861372238119845</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3861372238119845</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1515"><ip.session_id>758</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5897679328918457</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3861349842583606</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3861349842583606</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>544</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>544</min_tcp_pkts><max_tcp_pkts>544</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1516"><ip.session_id>759</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.589776039123535</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.008106231689453125</time_between_pkts_sum><time_between_pkts_avg>0.008106231689453125</time_between_pkts_avg><time_between_pkts_max>0.008106231689453125</time_between_pkts_max><time_between_pkts_min>0.008106231689453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38613377562116635</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38613377562116635</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1517"><ip.session_id>759</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5897839069366455</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.007867813110351562</time_between_pkts_sum><time_between_pkts_avg>0.007867813110351562</time_between_pkts_avg><time_between_pkts_max>0.007867813110351562</time_between_pkts_max><time_between_pkts_min>0.007867813110351562</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38613260253936055</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38613260253936055</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>7800</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>7800</min_tcp_pkts><max_tcp_pkts>7800</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1518"><ip.session_id>760</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.589776039123535</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38613377562116635</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38613377562116635</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1519"><ip.session_id>760</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.589792013168335</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.008106231689453125</time_between_pkts_sum><time_between_pkts_avg>0.008106231689453125</time_between_pkts_avg><time_between_pkts_max>0.008106231689453125</time_between_pkts_max><time_between_pkts_min>0.008106231689453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3861313939170761</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3861313939170761</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1998</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1998</min_tcp_pkts><max_tcp_pkts>1998</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1520"><ip.session_id>761</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.589776039123535</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38613377562116635</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38613377562116635</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1521"><ip.session_id>761</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5897960662841797</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0040531158447265625</time_between_pkts_sum><time_between_pkts_avg>0.0040531158447265625</time_between_pkts_avg><time_between_pkts_max>0.0040531158447265625</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38613078960877123</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38613078960877123</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>18101</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>18101</min_tcp_pkts><max_tcp_pkts>18101</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1522"><ip.session_id>762</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.589776039123535</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38613377562116635</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38613377562116635</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1523"><ip.session_id>762</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.589801073074341</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38613004311288845</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38613004311288845</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>14238</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>14238</min_tcp_pkts><max_tcp_pkts>14238</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1524"><ip.session_id>763</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.589806079864502</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.386129296619892</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.386129296619892</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1525"><ip.session_id>763</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.589843988418579</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.03790855407714844</time_between_pkts_sum><time_between_pkts_avg>0.03790855407714844</time_between_pkts_avg><time_between_pkts_max>0.03790855407714844</time_between_pkts_max><time_between_pkts_min>0.03790855407714844</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3861236446951478</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3861236446951478</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>765</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>765</min_tcp_pkts><max_tcp_pkts>765</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1526"><ip.session_id>764</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.589806079864502</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.386129296619892</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.386129296619892</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1527"><ip.session_id>764</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5898520946502686</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.008106231689453125</time_between_pkts_sum><time_between_pkts_avg>0.008106231689453125</time_between_pkts_avg><time_between_pkts_max>0.008106231689453125</time_between_pkts_max><time_between_pkts_min>0.008106231689453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3861224361289401</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3861224361289401</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>2710</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>2710</min_tcp_pkts><max_tcp_pkts>2710</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1528"><ip.session_id>765</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.589806079864502</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.386129296619892</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.386129296619892</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1529"><ip.session_id>765</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5898571014404297</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.386121689665356</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.386121689665356</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>6346</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>6346</min_tcp_pkts><max_tcp_pkts>6346</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1530"><ip.session_id>766</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5900890827178955</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.2319812774658203</time_between_pkts_sum><time_between_pkts_avg>0.2319812774658203</time_between_pkts_avg><time_between_pkts_max>0.2319812774658203</time_between_pkts_max><time_between_pkts_min>0.2319812774658203</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.386087106683858</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.386087106683858</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1531"><ip.session_id>766</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5900959968566895</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3860860760425824</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3860860760425824</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>2301</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>2301</min_tcp_pkts><max_tcp_pkts>2301</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1532"><ip.session_id>767</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5905020236968994</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.40602684020996094</time_between_pkts_sum><time_between_pkts_avg>0.40602684020996094</time_between_pkts_avg><time_between_pkts_max>0.40602684020996094</time_between_pkts_max><time_between_pkts_min>0.40602684020996094</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3860255621699544</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3860255621699544</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1533"><ip.session_id>767</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.590507984161377</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.386024673969005</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.386024673969005</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>9081</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>9081</min_tcp_pkts><max_tcp_pkts>9081</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1534"><ip.session_id>768</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.590528964996338</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0209808349609375</time_between_pkts_sum><time_between_pkts_avg>0.0209808349609375</time_between_pkts_avg><time_between_pkts_max>0.0209808349609375</time_between_pkts_max><time_between_pkts_min>0.0209808349609375</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38602154753417844</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38602154753417844</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1535"><ip.session_id>768</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.590533971786499</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38602080146062484</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38602080146062484</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>2047</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>2047</min_tcp_pkts><max_tcp_pkts>2047</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1536"><ip.session_id>769</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5905399322509766</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.386019913281583</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.386019913281583</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1537"><ip.session_id>769</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5905439853668213</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0040531158447265625</time_between_pkts_sum><time_between_pkts_avg>0.0040531158447265625</time_between_pkts_avg><time_between_pkts_max>0.0040531158447265625</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3860193093221692</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3860193093221692</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>5101</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>5101</min_tcp_pkts><max_tcp_pkts>5101</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1538"><ip.session_id>770</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.590588092803955</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.04410743713378906</time_between_pkts_sum><time_between_pkts_avg>0.04410743713378906</time_between_pkts_avg><time_between_pkts_max>0.04410743713378906</time_between_pkts_max><time_between_pkts_min>0.04410743713378906</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3860127369448524</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3860127369448524</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1539"><ip.session_id>770</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.590595006942749</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38601170670059104</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38601170670059104</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>3367</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>3367</min_tcp_pkts><max_tcp_pkts>3367</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1540"><ip.session_id>771</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5905990600585938</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0040531158447265625</time_between_pkts_sum><time_between_pkts_avg>0.0040531158447265625</time_between_pkts_avg><time_between_pkts_max>0.0040531158447265625</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38601110276685663</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38601110276685663</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1541"><ip.session_id>771</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.590604066848755</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3860103567336761</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3860103567336761</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1023</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1023</min_tcp_pkts><max_tcp_pkts>1023</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1542"><ip.session_id>772</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.590639114379883</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.03504753112792969</time_between_pkts_sum><time_between_pkts_avg>0.03504753112792969</time_between_pkts_avg><time_between_pkts_max>0.03504753112792969</time_between_pkts_max><time_between_pkts_min>0.03504753112792969</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3860051345821544</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3860051345821544</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1543"><ip.session_id>772</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.590644121170044</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38600438857204283</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38600438857204283</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1089</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1089</min_tcp_pkts><max_tcp_pkts>1089</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1544"><ip.session_id>773</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.590686082839966</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.041961669921875</time_between_pkts_sum><time_between_pkts_avg>0.041961669921875</time_between_pkts_avg><time_between_pkts_max>0.041961669921875</time_between_pkts_max><time_between_pkts_min>0.041961669921875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38599813641017383</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38599813641017383</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1545"><ip.session_id>773</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.590691089630127</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3859973904271119</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3859973904271119</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>20828</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>20828</min_tcp_pkts><max_tcp_pkts>20828</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1546"><ip.session_id>774</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5907490253448486</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.05793571472167969</time_between_pkts_sum><time_between_pkts_avg>0.05793571472167969</time_between_pkts_avg><time_between_pkts_max>0.05793571472167969</time_between_pkts_max><time_between_pkts_min>0.05793571472167969</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38598875854711256</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38598875854711256</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1547"><ip.session_id>774</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5907809734344482</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.031948089599609375</time_between_pkts_sum><time_between_pkts_avg>0.031948089599609375</time_between_pkts_avg><time_between_pkts_max>0.031948089599609375</time_between_pkts_max><time_between_pkts_min>0.031948089599609375</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3859839987455049</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3859839987455049</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1717</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1717</min_tcp_pkts><max_tcp_pkts>1717</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1548"><ip.session_id>775</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5908260345458984</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.04506111145019531</time_between_pkts_sum><time_between_pkts_avg>0.04506111145019531</time_between_pkts_avg><time_between_pkts_max>0.04506111145019531</time_between_pkts_max><time_between_pkts_min>0.04506111145019531</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3859772854935329</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3859772854935329</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1549"><ip.session_id>775</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5908329486846924</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38597625543849806</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38597625543849806</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>10616</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>10616</min_tcp_pkts><max_tcp_pkts>10616</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1550"><ip.session_id>776</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5908899307250977</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.05698204040527344</time_between_pkts_sum><time_between_pkts_avg>0.05698204040527344</time_between_pkts_avg><time_between_pkts_max>0.05698204040527344</time_between_pkts_max><time_between_pkts_min>0.05698204040527344</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3859677665736019</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3859677665736019</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1551"><ip.session_id>776</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5908961296081543</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.006198883056640625</time_between_pkts_sum><time_between_pkts_avg>0.006198883056640625</time_between_pkts_avg><time_between_pkts_max>0.006198883056640625</time_between_pkts_max><time_between_pkts_min>0.006198883056640625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3859668431212792</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3859668431212792</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>54045</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>54045</min_tcp_pkts><max_tcp_pkts>54045</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1552"><ip.session_id>777</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.590920925140381</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0247955322265625</time_between_pkts_sum><time_between_pkts_avg>0.0247955322265625</time_between_pkts_avg><time_between_pkts_max>0.0247955322265625</time_between_pkts_max><time_between_pkts_min>0.0247955322265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3859631493561766</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3859631493561766</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1553"><ip.session_id>777</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.590928077697754</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.007152557373046875</time_between_pkts_sum><time_between_pkts_avg>0.007152557373046875</time_between_pkts_avg><time_between_pkts_max>0.007152557373046875</time_between_pkts_max><time_between_pkts_min>0.007152557373046875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38596208386015085</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38596208386015085</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>2038</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>2038</min_tcp_pkts><max_tcp_pkts>2038</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1554"><ip.session_id>778</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.590920925140381</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3859631493561766</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3859631493561766</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1555"><ip.session_id>778</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5909340381622314</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38596119595128997</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38596119595128997</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1322</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1322</min_tcp_pkts><max_tcp_pkts>1322</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1556"><ip.session_id>779</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.590970993041992</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.03695487976074219</time_between_pkts_sum><time_between_pkts_avg>0.03695487976074219</time_between_pkts_avg><time_between_pkts_max>0.03695487976074219</time_between_pkts_max><time_between_pkts_min>0.03695487976074219</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3859556910075345</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3859556910075345</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1557"><ip.session_id>779</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5909759998321533</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.385954945188524</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.385954945188524</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>2043</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>2043</min_tcp_pkts><max_tcp_pkts>2043</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1558"><ip.session_id>780</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.591059923171997</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.08392333984375</time_between_pkts_sum><time_between_pkts_avg>0.08392333984375</time_between_pkts_avg><time_between_pkts_max>0.08392333984375</time_between_pkts_max><time_between_pkts_min>0.08392333984375</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3859424442703709</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3859424442703709</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1559"><ip.session_id>780</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.591064929962158</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3859416985025554</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3859416985025554</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>2007</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>2007</min_tcp_pkts><max_tcp_pkts>2007</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1560"><ip.session_id>781</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.591089963912964</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.025033950805664062</time_between_pkts_sum><time_between_pkts_avg>0.025033950805664062</time_between_pkts_avg><time_between_pkts_max>0.025033950805664062</time_between_pkts_max><time_between_pkts_min>0.025033950805664062</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38593796970670935</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38593796970670935</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1561"><ip.session_id>781</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5910990238189697</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.009059906005859375</time_between_pkts_sum><time_between_pkts_avg>0.009059906005859375</time_between_pkts_avg><time_between_pkts_max>0.009059906005859375</time_between_pkts_max><time_between_pkts_min>0.009059906005859375</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38593662025549286</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38593662025549286</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>7778</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>7778</min_tcp_pkts><max_tcp_pkts>7778</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1562"><ip.session_id>782</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.591089963912964</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38593796970670935</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38593796970670935</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1563"><ip.session_id>782</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5911049842834473</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38593573246378643</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38593573246378643</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>406</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>406</min_tcp_pkts><max_tcp_pkts>406</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1564"><ip.session_id>783</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.591089963912964</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38593796970670935</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38593796970670935</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1565"><ip.session_id>783</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.591109037399292</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0040531158447265625</time_between_pkts_sum><time_between_pkts_avg>0.0040531158447265625</time_between_pkts_avg><time_between_pkts_max>0.0040531158447265625</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3859351287677591</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3859351287677591</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>3325</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>3325</min_tcp_pkts><max_tcp_pkts>3325</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1566"><ip.session_id>784</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5911319255828857</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.02288818359375</time_between_pkts_sum><time_between_pkts_avg>0.02288818359375</time_between_pkts_avg><time_between_pkts_max>0.02288818359375</time_between_pkts_max><time_between_pkts_min>0.02288818359375</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3859317196962273</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3859317196962273</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1567"><ip.session_id>784</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5911381244659424</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.006198883056640625</time_between_pkts_sum><time_between_pkts_avg>0.006198883056640625</time_between_pkts_avg><time_between_pkts_max>0.006198883056640625</time_between_pkts_max><time_between_pkts_min>0.006198883056640625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3859307964163853</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3859307964163853</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>16001</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>16001</min_tcp_pkts><max_tcp_pkts>16001</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1568"><ip.session_id>785</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5911600589752197</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.02193450927734375</time_between_pkts_sum><time_between_pkts_avg>0.02193450927734375</time_between_pkts_avg><time_between_pkts_max>0.02193450927734375</time_between_pkts_max><time_between_pkts_min>0.02193450927734375</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3859275294616462</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3859275294616462</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1569"><ip.session_id>785</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5911660194396973</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38592664171176333</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38592664171176333</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1093</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1093</min_tcp_pkts><max_tcp_pkts>1093</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1570"><ip.session_id>786</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.5911929607391357</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.026941299438476562</time_between_pkts_sum><time_between_pkts_avg>0.026941299438476562</time_between_pkts_avg><time_between_pkts_max>0.026941299438476562</time_between_pkts_max><time_between_pkts_min>0.026941299438476562</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38592262913324327</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38592262913324327</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1571"><ip.session_id>786</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.591197967529297</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3859218834420044</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3859218834420044</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1761</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1761</min_tcp_pkts><max_tcp_pkts>1761</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1572"><ip.session_id>787</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6161839962005615</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>16.192913055419922</time_between_pkts_sum><time_between_pkts_avg>16.192913055419922</time_between_pkts_avg><time_between_pkts_max>16.192913055419922</time_between_pkts_max><time_between_pkts_min>16.192913055419922</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3822361123882275</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3822361123882275</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1573"><ip.session_id>787</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6162030696868896</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.019073486328125</time_between_pkts_sum><time_between_pkts_avg>0.019073486328125</time_between_pkts_avg><time_between_pkts_max>0.019073486328125</time_between_pkts_max><time_between_pkts_min>0.019073486328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38223332568739826</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38223332568739826</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1185</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1185</min_tcp_pkts><max_tcp_pkts>1185</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1574"><ip.session_id>788</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6162750720977783</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.07200241088867188</time_between_pkts_sum><time_between_pkts_avg>0.07200241088867188</time_between_pkts_avg><time_between_pkts_max>0.07200241088867188</time_between_pkts_max><time_between_pkts_min>0.07200241088867188</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3822228062579755</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3822228062579755</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1575"><ip.session_id>788</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.616281032562256</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38222193547023103</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38222193547023103</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>49163</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>49163</min_tcp_pkts><max_tcp_pkts>49163</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1576"><ip.session_id>789</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6163558959960938</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.07486343383789062</time_between_pkts_sum><time_between_pkts_avg>0.07486343383789062</time_between_pkts_avg><time_between_pkts_max>0.07486343383789062</time_between_pkts_max><time_between_pkts_min>0.07486343383789062</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38221099871402703</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38221099871402703</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1577"><ip.session_id>789</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.616368055343628</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.012159347534179688</time_between_pkts_sum><time_between_pkts_avg>0.012159347534179688</time_between_pkts_avg><time_between_pkts_max>0.012159347534179688</time_between_pkts_max><time_between_pkts_min>0.012159347534179688</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3822092224209878</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3822092224209878</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>3371</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>3371</min_tcp_pkts><max_tcp_pkts>3371</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1578"><ip.session_id>790</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6163558959960938</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38221099871402703</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38221099871402703</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1579"><ip.session_id>790</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.616377115249634</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.009059906005859375</time_between_pkts_sum><time_between_pkts_avg>0.009059906005859375</time_between_pkts_avg><time_between_pkts_max>0.009059906005859375</time_between_pkts_max><time_between_pkts_min>0.009059906005859375</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3822078989192611</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3822078989192611</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>4005</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>4005</min_tcp_pkts><max_tcp_pkts>4005</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1580"><ip.session_id>791</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6163558959960938</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38221099871402703</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38221099871402703</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1581"><ip.session_id>791</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6163830757141113</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38220702819943964</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38220702819943964</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>3784</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>3784</min_tcp_pkts><max_tcp_pkts>3784</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1582"><ip.session_id>792</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6163880825042725</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3822062967978555</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3822062967978555</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1583"><ip.session_id>792</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.61639404296875</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3822054260853337</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3822054260853337</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>8290</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>8290</min_tcp_pkts><max_tcp_pkts>8290</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1584"><ip.session_id>793</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6163880825042725</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3822062967978555</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3822062967978555</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1585"><ip.session_id>793</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.616400957107544</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3822044160637785</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3822044160637785</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>5225</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>5225</min_tcp_pkts><max_tcp_pkts>5225</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1586"><ip.session_id>794</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6164259910583496</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.025033950805664062</time_between_pkts_sum><time_between_pkts_avg>0.025033950805664062</time_between_pkts_avg><time_between_pkts_max>0.025033950805664062</time_between_pkts_max><time_between_pkts_min>0.025033950805664062</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38220075913383583</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38220075913383583</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1587"><ip.session_id>794</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.616434097290039</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.008106231689453125</time_between_pkts_sum><time_between_pkts_avg>0.008106231689453125</time_between_pkts_avg><time_between_pkts_max>0.008106231689453125</time_between_pkts_max><time_between_pkts_min>0.008106231689453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3821995750000911</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3821995750000911</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>524</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>524</min_tcp_pkts><max_tcp_pkts>524</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1588"><ip.session_id>795</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6164259910583496</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38220075913383583</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38220075913383583</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1589"><ip.session_id>795</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6164400577545166</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3821987043181952</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3821987043181952</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>4224</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>4224</min_tcp_pkts><max_tcp_pkts>4224</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1590"><ip.session_id>796</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.616497039794922</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.05698204040527344</time_between_pkts_sum><time_between_pkts_avg>0.05698204040527344</time_between_pkts_avg><time_between_pkts_max>0.05698204040527344</time_between_pkts_max><time_between_pkts_min>0.05698204040527344</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38219038079950546</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38219038079950546</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1591"><ip.session_id>796</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6165030002593994</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38218951015949926</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38218951015949926</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1900</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1900</min_tcp_pkts><max_tcp_pkts>1900</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1592"><ip.session_id>797</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6165430545806885</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0400543212890625</time_between_pkts_sum><time_between_pkts_avg>0.0400543212890625</time_between_pkts_avg><time_between_pkts_max>0.0400543212890625</time_between_pkts_max><time_between_pkts_min>0.0400543212890625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3821836595615485</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3821836595615485</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1593"><ip.session_id>797</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6165499687194824</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3821826496550309</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3821826496550309</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>10009</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>10009</min_tcp_pkts><max_tcp_pkts>10009</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1594"><ip.session_id>798</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6165549755096436</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38218191834674653</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38218191834674653</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1595"><ip.session_id>798</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.616560935974121</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38218104774529527</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38218104774529527</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>7201</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>7201</min_tcp_pkts><max_tcp_pkts>7201</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1596"><ip.session_id>799</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6165549755096436</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38218191834674653</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38218191834674653</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1597"><ip.session_id>799</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6165668964385986</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3821801771478104</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3821801771478104</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>4</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>4</min_tcp_pkts><max_tcp_pkts>4</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1598"><ip.session_id>800</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.616671085357666</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.10418891906738281</time_between_pkts_sum><time_between_pkts_avg>0.10418891906738281</time_between_pkts_avg><time_between_pkts_max>0.10418891906738281</time_between_pkts_max><time_between_pkts_min>0.10418891906738281</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3821649597443817</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3821649597443817</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1599"><ip.session_id>800</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6166770458221436</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3821640892201912</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3821640892201912</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>65389</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>65389</min_tcp_pkts><max_tcp_pkts>65389</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1600"><ip.session_id>801</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.616683006286621</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38216321869996656</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38216321869996656</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1601"><ip.session_id>801</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.616689920425415</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38216220890147445</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38216220890147445</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1099</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1099</min_tcp_pkts><max_tcp_pkts>1099</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1602"><ip.session_id>802</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.616683006286621</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38216321869996656</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38216321869996656</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1603"><ip.session_id>802</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6166961193084717</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.006198883056640625</time_between_pkts_sum><time_between_pkts_avg>0.006198883056640625</time_between_pkts_avg><time_between_pkts_max>0.006198883056640625</time_between_pkts_max><time_between_pkts_min>0.006198883056640625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3821613035694322</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3821613035694322</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1112</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1112</min_tcp_pkts><max_tcp_pkts>1112</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1604"><ip.session_id>803</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6166999340057373</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.003814697265625</time_between_pkts_sum><time_between_pkts_avg>0.003814697265625</time_between_pkts_avg><time_between_pkts_max>0.003814697265625</time_between_pkts_max><time_between_pkts_min>0.003814697265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3821607464441536</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3821607464441536</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1605"><ip.session_id>803</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.616703987121582</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0040531158447265625</time_between_pkts_sum><time_between_pkts_avg>0.0040531158447265625</time_between_pkts_avg><time_between_pkts_max>0.0040531158447265625</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3821601545003249</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3821601545003249</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>2103</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>2103</min_tcp_pkts><max_tcp_pkts>2103</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1606"><ip.session_id>804</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6171159744262695</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.4119873046875</time_between_pkts_sum><time_between_pkts_avg>0.4119873046875</time_between_pkts_avg><time_between_pkts_max>0.4119873046875</time_between_pkts_max><time_between_pkts_min>0.4119873046875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3820999947162152</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3820999947162152</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1607"><ip.session_id>804</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.617121934890747</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3820991244879637</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3820991244879637</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>5989</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>5989</min_tcp_pkts><max_tcp_pkts>5989</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1608"><ip.session_id>805</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6171441078186035</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.022172927856445312</time_between_pkts_sum><time_between_pkts_avg>0.022172927856445312</time_between_pkts_avg><time_between_pkts_max>0.022172927856445312</time_between_pkts_max><time_between_pkts_min>0.022172927856445312</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3820958872736674</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3820958872736674</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1609"><ip.session_id>805</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.617151975631714</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.007867813110351562</time_between_pkts_sum><time_between_pkts_avg>0.007867813110351562</time_between_pkts_avg><time_between_pkts_max>0.007867813110351562</time_between_pkts_max><time_between_pkts_min>0.007867813110351562</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3820947385979087</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3820947385979087</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>9071</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>9071</min_tcp_pkts><max_tcp_pkts>9071</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1610"><ip.session_id>806</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6171441078186035</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3820958872736674</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3820958872736674</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1611"><ip.session_id>806</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6171579360961914</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3820938683935985</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3820938683935985</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>32777</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>32777</min_tcp_pkts><max_tcp_pkts>32777</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1612"><ip.session_id>807</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6171610355377197</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0030994415283203125</time_between_pkts_sum><time_between_pkts_avg>0.0030994415283203125</time_between_pkts_avg><time_between_pkts_max>0.0030994415283203125</time_between_pkts_max><time_between_pkts_min>0.0030994415283203125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38209341588892365</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38209341588892365</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1613"><ip.session_id>807</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.617166042327881</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3820926849220975</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3820926849220975</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>2048</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>2048</min_tcp_pkts><max_tcp_pkts>2048</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1614"><ip.session_id>808</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.617177963256836</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.011920928955078125</time_between_pkts_sum><time_between_pkts_avg>0.011920928955078125</time_between_pkts_avg><time_between_pkts_max>0.011920928955078125</time_between_pkts_max><time_between_pkts_min>0.011920928955078125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38209094453614934</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38209094453614934</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1615"><ip.session_id>808</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6171839237213135</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3820900743491207</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3820900743491207</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>2105</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>2105</min_tcp_pkts><max_tcp_pkts>2105</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1616"><ip.session_id>809</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.617219924926758</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.03600120544433594</time_between_pkts_sum><time_between_pkts_avg>0.03600120544433594</time_between_pkts_avg><time_between_pkts_max>0.03600120544433594</time_between_pkts_max><time_between_pkts_min>0.03600120544433594</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3820848185037353</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3820848185037353</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1617"><ip.session_id>809</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6172280311584473</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.008106231689453125</time_between_pkts_sum><time_between_pkts_avg>0.008106231689453125</time_between_pkts_avg><time_between_pkts_max>0.008106231689453125</time_between_pkts_max><time_between_pkts_min>0.008106231689453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3820836350882946</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3820836350882946</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>49176</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>49176</min_tcp_pkts><max_tcp_pkts>49176</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1618"><ip.session_id>810</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.617219924926758</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3820848185037353</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3820848185037353</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1619"><ip.session_id>810</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6172358989715576</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.007867813110351562</time_between_pkts_sum><time_between_pkts_avg>0.007867813110351562</time_between_pkts_avg><time_between_pkts_max>0.007867813110351562</time_between_pkts_max><time_between_pkts_min>0.007867813110351562</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3820824864862009</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3820824864862009</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>2998</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>2998</min_tcp_pkts><max_tcp_pkts>2998</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1620"><ip.session_id>811</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.617264986038208</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.029087066650390625</time_between_pkts_sum><time_between_pkts_avg>0.029087066650390625</time_between_pkts_avg><time_between_pkts_max>0.029087066650390625</time_between_pkts_max><time_between_pkts_min>0.029087066650390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38207824019902337</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38207824019902337</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1621"><ip.session_id>811</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6172709465026855</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38207737006986026</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38207737006986026</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>49156</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>49156</min_tcp_pkts><max_tcp_pkts>49156</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1622"><ip.session_id>812</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.617314100265503</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.04315376281738281</time_between_pkts_sum><time_between_pkts_avg>0.04315376281738281</time_between_pkts_avg><time_between_pkts_max>0.04315376281738281</time_between_pkts_max><time_between_pkts_min>0.04315376281738281</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38207107045293454</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38207107045293454</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1623"><ip.session_id>812</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.617319107055664</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38207033957160214</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38207033957160214</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>9000</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>9000</min_tcp_pkts><max_tcp_pkts>9000</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1624"><ip.session_id>813</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.617356061935425</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.03695487976074219</time_between_pkts_sum><time_between_pkts_avg>0.03695487976074219</time_between_pkts_avg><time_between_pkts_max>0.03695487976074219</time_between_pkts_max><time_between_pkts_min>0.03695487976074219</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3820649450577779</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3820649450577779</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1625"><ip.session_id>813</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.617363929748535</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38206379656805145</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38206379656805145</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>7004</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>7004</min_tcp_pkts><max_tcp_pkts>7004</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1626"><ip.session_id>814</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.617357015609741</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.00095367431640625</time_between_pkts_sum><time_between_pkts_avg>0.00095367431640625</time_between_pkts_avg><time_between_pkts_max>0.00095367431640625</time_between_pkts_max><time_between_pkts_min>0.00095367431640625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38206480584653424</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38206480584653424</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1627"><ip.session_id>814</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.617370128631592</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.006198883056640625</time_between_pkts_sum><time_between_pkts_avg>0.006198883056640625</time_between_pkts_avg><time_between_pkts_max>0.006198883056640625</time_between_pkts_max><time_between_pkts_min>0.006198883056640625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38206289170222096</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38206289170222096</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1040</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1040</min_tcp_pkts><max_tcp_pkts>1040</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1628"><ip.session_id>815</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6173930168151855</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.02288818359375</time_between_pkts_sum><time_between_pkts_avg>0.02288818359375</time_between_pkts_avg><time_between_pkts_max>0.02288818359375</time_between_pkts_max><time_between_pkts_min>0.02288818359375</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38205955069628356</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38205955069628356</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1629"><ip.session_id>815</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.617398977279663</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3820586806522437</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3820586806522437</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>6006</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>6006</min_tcp_pkts><max_tcp_pkts>6006</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1630"><ip.session_id>816</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6173930168151855</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38205955069628356</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38205955069628356</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1631"><ip.session_id>816</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6174049377441406</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38205781061216637</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38205781061216637</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>7443</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>7443</min_tcp_pkts><max_tcp_pkts>7443</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1632"><ip.session_id>817</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.61747407913208</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.06914138793945312</time_between_pkts_sum><time_between_pkts_avg>0.06914138793945312</time_between_pkts_avg><time_between_pkts_max>0.06914138793945312</time_between_pkts_max><time_between_pkts_min>0.06914138793945312</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38204771843684765</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38204771843684765</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1633"><ip.session_id>817</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6174819469451904</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.007867813110351562</time_between_pkts_sum><time_between_pkts_avg>0.007867813110351562</time_between_pkts_avg><time_between_pkts_max>0.007867813110351562</time_between_pkts_max><time_between_pkts_min>0.007867813110351562</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3820465700506854</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3820465700506854</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>9290</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>9290</min_tcp_pkts><max_tcp_pkts>9290</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1634"><ip.session_id>818</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.61747407913208</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38204771843684765</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38204771843684765</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1635"><ip.session_id>818</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6174890995025635</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.007152557373046875</time_between_pkts_sum><time_between_pkts_avg>0.007152557373046875</time_between_pkts_avg><time_between_pkts_max>0.007152557373046875</time_between_pkts_max><time_between_pkts_min>0.007152557373046875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.382045526069256</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.382045526069256</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1455</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1455</min_tcp_pkts><max_tcp_pkts>1455</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1636"><ip.session_id>819</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.617492914199829</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.003814697265625</time_between_pkts_sum><time_between_pkts_avg>0.003814697265625</time_between_pkts_avg><time_between_pkts_max>0.003814697265625</time_between_pkts_max><time_between_pkts_min>0.003814697265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3820449692814933</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3820449692814933</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1637"><ip.session_id>819</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.617496967315674</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0040531158447265625</time_between_pkts_sum><time_between_pkts_avg>0.0040531158447265625</time_between_pkts_avg><time_between_pkts_max>0.0040531158447265625</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3820443776962736</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3820443776962736</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>9418</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>9418</min_tcp_pkts><max_tcp_pkts>9418</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1638"><ip.session_id>820</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6175479888916016</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.051021575927734375</time_between_pkts_sum><time_between_pkts_avg>0.051021575927734375</time_between_pkts_avg><time_between_pkts_max>0.051021575927734375</time_between_pkts_max><time_between_pkts_min>0.051021575927734375</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3820369308390213</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3820369308390213</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1639"><ip.session_id>820</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.617553949356079</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3820360608980002</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3820360608980002</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>3128</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>3128</min_tcp_pkts><max_tcp_pkts>3128</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1640"><ip.session_id>821</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6175599098205566</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3820351909609411</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3820351909609411</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1641"><ip.session_id>821</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6175639629364014</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0040531158447265625</time_between_pkts_sum><time_between_pkts_avg>0.0040531158447265625</time_between_pkts_avg><time_between_pkts_max>0.0040531158447265625</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38203459940600387</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38203459940600387</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>8083</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>8083</min_tcp_pkts><max_tcp_pkts>8083</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1642"><ip.session_id>822</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.617588996887207</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.025033950805664062</time_between_pkts_sum><time_between_pkts_avg>0.025033950805664062</time_between_pkts_avg><time_between_pkts_max>0.025033950805664062</time_between_pkts_max><time_between_pkts_min>0.025033950805664062</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3820309457249336</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3820309457249336</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1643"><ip.session_id>822</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.617594003677368</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3820302149971058</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3820302149971058</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>2381</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>2381</min_tcp_pkts><max_tcp_pkts>2381</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1644"><ip.session_id>823</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.617737054824829</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.1430511474609375</time_between_pkts_sum><time_between_pkts_avg>0.1430511474609375</time_between_pkts_avg><time_between_pkts_max>0.1430511474609375</time_between_pkts_max><time_between_pkts_min>0.1430511474609375</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38200933824001543</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38200933824001543</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1645"><ip.session_id>823</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6177420616149902</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38200860759484445</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38200860759484445</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>89</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>89</min_tcp_pkts><max_tcp_pkts>89</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1646"><ip.session_id>824</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6178290843963623</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.08702278137207031</time_between_pkts_sum><time_between_pkts_avg>0.08702278137207031</time_between_pkts_avg><time_between_pkts_max>0.08702278137207031</time_between_pkts_max><time_between_pkts_min>0.08702278137207031</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38199590873236366</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38199590873236366</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1647"><ip.session_id>824</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6178369522094727</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.007867813110351562</time_between_pkts_sum><time_between_pkts_avg>0.007867813110351562</time_between_pkts_avg><time_between_pkts_max>0.007867813110351562</time_between_pkts_max><time_between_pkts_min>0.007867813110351562</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38199476065764637</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38199476065764637</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>691</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>691</min_tcp_pkts><max_tcp_pkts>691</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1648"><ip.session_id>825</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6178290843963623</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38199590873236366</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38199590873236366</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1649"><ip.session_id>825</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6178441047668457</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.007152557373046875</time_between_pkts_sum><time_between_pkts_avg>0.007152557373046875</time_between_pkts_avg><time_between_pkts_max>0.007152557373046875</time_between_pkts_max><time_between_pkts_min>0.007152557373046875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3819937169593464</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3819937169593464</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1102</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1102</min_tcp_pkts><max_tcp_pkts>1102</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1650"><ip.session_id>826</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6178479194641113</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.003814697265625</time_between_pkts_sum><time_between_pkts_avg>0.003814697265625</time_between_pkts_avg><time_between_pkts_max>0.003814697265625</time_between_pkts_max><time_between_pkts_min>0.003814697265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38199316032258507</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38199316032258507</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1651"><ip.session_id>826</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.617851972579956</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0040531158447265625</time_between_pkts_sum><time_between_pkts_avg>0.0040531158447265625</time_between_pkts_avg><time_between_pkts_max>0.0040531158447265625</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38199256889780364</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38199256889780364</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1718</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1718</min_tcp_pkts><max_tcp_pkts>1718</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1652"><ip.session_id>827</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.617867946624756</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.015974044799804688</time_between_pkts_sum><time_between_pkts_avg>0.015974044799804688</time_between_pkts_avg><time_between_pkts_max>0.015974044799804688</time_between_pkts_max><time_between_pkts_min>0.015974044799804688</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38199023800620285</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38199023800620285</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1653"><ip.session_id>827</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.617875099182129</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.007152557373046875</time_between_pkts_sum><time_between_pkts_avg>0.007152557373046875</time_between_pkts_avg><time_between_pkts_max>0.007152557373046875</time_between_pkts_max><time_between_pkts_min>0.007152557373046875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3819891943326165</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3819891943326165</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1840</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1840</min_tcp_pkts><max_tcp_pkts>1840</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1654"><ip.session_id>828</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.617867946624756</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38199023800620285</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38199023800620285</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1655"><ip.session_id>828</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6178829669952393</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.007867813110351562</time_between_pkts_sum><time_between_pkts_avg>0.007867813110351562</time_between_pkts_avg><time_between_pkts_max>0.007867813110351562</time_between_pkts_max><time_between_pkts_min>0.007867813110351562</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3819880462982586</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3819880462982586</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>4004</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>4004</min_tcp_pkts><max_tcp_pkts>4004</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1656"><ip.session_id>829</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.617887020111084</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0040531158447265625</time_between_pkts_sum><time_between_pkts_avg>0.0040531158447265625</time_between_pkts_avg><time_between_pkts_max>0.0040531158447265625</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38198745488931274</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38198745488931274</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1657"><ip.session_id>829</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.617893934249878</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38198644601945514</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38198644601945514</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>16000</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>16000</min_tcp_pkts><max_tcp_pkts>16000</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1658"><ip.session_id>830</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.617887020111084</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38198745488931274</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38198745488931274</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1659"><ip.session_id>830</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.617898941040039</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38198571546185045</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38198571546185045</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1114</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1114</min_tcp_pkts><max_tcp_pkts>1114</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1660"><ip.session_id>831</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.617887020111084</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38198745488931274</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38198745488931274</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1661"><ip.session_id>831</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6179039478302</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3819849849070402</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3819849849070402</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1132</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1132</min_tcp_pkts><max_tcp_pkts>1132</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1662"><ip.session_id>832</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.617906093597412</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0021457672119140625</time_between_pkts_sum><time_between_pkts_avg>0.0021457672119140625</time_between_pkts_avg><time_between_pkts_max>0.0021457672119140625</time_between_pkts_max><time_between_pkts_min>0.0021457672119140625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38198467181297696</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38198467181297696</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1663"><ip.session_id>832</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.617913007736206</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3819836629578201</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3819836629578201</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>6025</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>6025</min_tcp_pkts><max_tcp_pkts>6025</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1664"><ip.session_id>833</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.617906093597412</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38198467181297696</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38198467181297696</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1665"><ip.session_id>833</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.617918014526367</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38198293241086073</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38198293241086073</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>15003</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>15003</min_tcp_pkts><max_tcp_pkts>15003</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1666"><ip.session_id>834</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.617906093597412</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38198467181297696</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38198467181297696</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1667"><ip.session_id>834</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6179230213165283</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3819822018666957</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3819822018666957</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>6005</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>6005</min_tcp_pkts><max_tcp_pkts>6005</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1668"><ip.session_id>835</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.617924928665161</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0019073486328125</time_between_pkts_sum><time_between_pkts_avg>0.0019073486328125</time_between_pkts_avg><time_between_pkts_max>0.0019073486328125</time_between_pkts_max><time_between_pkts_min>0.0019073486328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38198192356489163</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38198192356489163</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1669"><ip.session_id>835</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6179311275482178</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.006198883056640625</time_between_pkts_sum><time_between_pkts_avg>0.006198883056640625</time_between_pkts_avg><time_between_pkts_max>0.006198883056640625</time_between_pkts_max><time_between_pkts_min>0.006198883056640625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3819810190868292</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3819810190868292</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1236</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1236</min_tcp_pkts><max_tcp_pkts>1236</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1670"><ip.session_id>836</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.617924928665161</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38198192356489163</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38198192356489163</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1671"><ip.session_id>836</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6179330348968506</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0019073486328125</time_between_pkts_sum><time_between_pkts_avg>0.0019073486328125</time_between_pkts_avg><time_between_pkts_max>0.0019073486328125</time_between_pkts_max><time_between_pkts_min>0.0019073486328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3819807407867486</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3819807407867486</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>555</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>555</min_tcp_pkts><max_tcp_pkts>555</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1672"><ip.session_id>837</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6187970638275146</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.8640289306640625</time_between_pkts_sum><time_between_pkts_avg>0.8640289306640625</time_between_pkts_avg><time_between_pkts_max>0.8640289306640625</time_between_pkts_max><time_between_pkts_min>0.8640289306640625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3818547125367727</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3818547125367727</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1673"><ip.session_id>837</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.618803024291992</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3818538434254159</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3818538434254159</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>9594</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>9594</min_tcp_pkts><max_tcp_pkts>9594</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1674"><ip.session_id>838</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.618830919265747</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.027894973754882812</time_between_pkts_sum><time_between_pkts_avg>0.027894973754882812</time_between_pkts_avg><time_between_pkts_max>0.027894973754882812</time_between_pkts_max><time_between_pkts_min>0.027894973754882812</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38184977603684866</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38184977603684866</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1675"><ip.session_id>838</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6188371181488037</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.006198883056640625</time_between_pkts_sum><time_between_pkts_avg>0.006198883056640625</time_between_pkts_avg><time_between_pkts_max>0.006198883056640625</time_between_pkts_max><time_between_pkts_min>0.006198883056640625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38184887218448976</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38184887218448976</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>8873</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>8873</min_tcp_pkts><max_tcp_pkts>8873</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1676"><ip.session_id>839</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.618842124938965</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3818481421530159</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3818481421530159</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1677"><ip.session_id>839</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6188480854034424</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3818472730715675</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3818472730715675</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1046</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1046</min_tcp_pkts><max_tcp_pkts>1046</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1678"><ip.session_id>840</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.618842124938965</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3818481421530159</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3818481421530159</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1679"><ip.session_id>840</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.61885404586792</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38184640399407516</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38184640399407516</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>2111</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>2111</min_tcp_pkts><max_tcp_pkts>2111</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1680"><ip.session_id>841</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6238820552825928</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>5.028009414672852</time_between_pkts_sum><time_between_pkts_avg>5.028009414672852</time_between_pkts_avg><time_between_pkts_max>5.028009414672852</time_between_pkts_max><time_between_pkts_min>5.028009414672852</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3811146914880287</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3811146914880287</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1681"><ip.session_id>841</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.623897075653076</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.015020370483398438</time_between_pkts_sum><time_between_pkts_avg>0.015020370483398438</time_between_pkts_avg><time_between_pkts_max>0.015020370483398438</time_between_pkts_max><time_between_pkts_min>0.015020370483398438</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38111250981561634</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38111250981561634</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1124</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1124</min_tcp_pkts><max_tcp_pkts>1124</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1682"><ip.session_id>842</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.62390398979187</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3811115055621074</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3811115055621074</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1683"><ip.session_id>842</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6239089965820312</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.381110778347353</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.381110778347353</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>79</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>79</min_tcp_pkts><max_tcp_pkts>79</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1684"><ip.session_id>843</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6239380836486816</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.029087066650390625</time_between_pkts_sum><time_between_pkts_avg>0.029087066650390625</time_between_pkts_avg><time_between_pkts_max>0.029087066650390625</time_between_pkts_max><time_between_pkts_min>0.029087066650390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3811065536308172</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3811065536308172</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1685"><ip.session_id>843</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6239469051361084</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.008821487426757812</time_between_pkts_sum><time_between_pkts_avg>0.008821487426757812</time_between_pkts_avg><time_between_pkts_max>0.008821487426757812</time_between_pkts_max><time_between_pkts_min>0.008821487426757812</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3811052723828375</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3811052723828375</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>4449</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>4449</min_tcp_pkts><max_tcp_pkts>4449</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1686"><ip.session_id>844</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6239380836486816</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3811065536308172</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3811065536308172</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1687"><ip.session_id>844</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.623953104019165</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.006198883056640625</time_between_pkts_sum><time_between_pkts_avg>0.006198883056640625</time_between_pkts_avg><time_between_pkts_max>0.006198883056640625</time_between_pkts_max><time_between_pkts_min>0.006198883056640625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3811043720515731</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3811043720515731</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1033</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1033</min_tcp_pkts><max_tcp_pkts>1033</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1688"><ip.session_id>845</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6239380836486816</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3811065536308172</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3811065536308172</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1689"><ip.session_id>845</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6239569187164307</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.003814697265625</time_between_pkts_sum><time_between_pkts_avg>0.003814697265625</time_between_pkts_avg><time_between_pkts_max>0.003814697265625</time_between_pkts_max><time_between_pkts_min>0.003814697265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38110381800367865</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38110381800367865</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1073</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1073</min_tcp_pkts><max_tcp_pkts>1073</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1690"><ip.session_id>846</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6239609718322754</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0040531158447265625</time_between_pkts_sum><time_between_pkts_avg>0.0040531158447265625</time_between_pkts_avg><time_between_pkts_max>0.0040531158447265625</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38110322932955587</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38110322932955587</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1691"><ip.session_id>846</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6239681243896484</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.007152557373046875</time_between_pkts_sum><time_between_pkts_avg>0.007152557373046875</time_between_pkts_avg><time_between_pkts_max>0.007152557373046875</time_between_pkts_max><time_between_pkts_min>0.007152557373046875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38110219049730504</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38110219049730504</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>20221</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>20221</min_tcp_pkts><max_tcp_pkts>20221</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1692"><ip.session_id>847</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6239609718322754</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38110322932955587</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38110322932955587</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1693"><ip.session_id>847</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6239728927612305</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.00476837158203125</time_between_pkts_sum><time_between_pkts_avg>0.00476837158203125</time_between_pkts_avg><time_between_pkts_max>0.00476837158203125</time_between_pkts_max><time_between_pkts_min>0.00476837158203125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3811014979456175</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3811014979456175</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>726</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>726</min_tcp_pkts><max_tcp_pkts>726</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1694"><ip.session_id>848</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6239609718322754</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38110322932955587</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38110322932955587</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1695"><ip.session_id>848</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.62398099899292</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.008106231689453125</time_between_pkts_sum><time_between_pkts_avg>0.008106231689453125</time_between_pkts_avg><time_between_pkts_max>0.008106231689453125</time_between_pkts_max><time_between_pkts_min>0.008106231689453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3811003206135252</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3811003206135252</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>32781</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>32781</min_tcp_pkts><max_tcp_pkts>32781</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1696"><ip.session_id>849</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.623995065689087</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.014066696166992188</time_between_pkts_sum><time_between_pkts_avg>0.014066696166992188</time_between_pkts_avg><time_between_pkts_max>0.014066696166992188</time_between_pkts_max><time_between_pkts_min>0.014066696166992188</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3810982776133347</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3810982776133347</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1697"><ip.session_id>849</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.624001979827881</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3810972734348296</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3810972734348296</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>3914</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>3914</min_tcp_pkts><max_tcp_pkts>3914</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1698"><ip.session_id>850</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.624006986618042</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.381096546274388</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.381096546274388</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1699"><ip.session_id>850</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6240129470825195</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3810956806108138</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3810956806108138</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>6004</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>6004</min_tcp_pkts><max_tcp_pkts>6004</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1700"><ip.session_id>851</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.624006986618042</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.381096546274388</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.381096546274388</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1701"><ip.session_id>851</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6240179538726807</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3810949534564506</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3810949534564506</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>4001</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>4001</min_tcp_pkts><max_tcp_pkts>4001</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1702"><ip.session_id>852</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6244750022888184</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.4570484161376953</time_between_pkts_sum><time_between_pkts_avg>0.4570484161376953</time_between_pkts_avg><time_between_pkts_max>0.4570484161376953</time_between_pkts_max><time_between_pkts_min>0.4570484161376953</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3810285863374179</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3810285863374179</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1703"><ip.session_id>852</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6244800090789795</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3810278594390721</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3810278594390721</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>50389</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>50389</min_tcp_pkts><max_tcp_pkts>50389</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1704"><ip.session_id>853</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.624552011489868</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.07200241088867188</time_between_pkts_sum><time_between_pkts_avg>0.07200241088867188</time_between_pkts_avg><time_between_pkts_max>0.07200241088867188</time_between_pkts_max><time_between_pkts_min>0.07200241088867188</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38101740625530006</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38101740625530006</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1705"><ip.session_id>853</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6245579719543457</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38101654095122234</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38101654095122234</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>33899</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>33899</min_tcp_pkts><max_tcp_pkts>33899</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1706"><ip.session_id>854</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.624569892883301</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.011920928955078125</time_between_pkts_sum><time_between_pkts_avg>0.011920928955078125</time_between_pkts_avg><time_between_pkts_max>0.011920928955078125</time_between_pkts_max><time_between_pkts_min>0.011920928955078125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3810148103548577</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3810148103548577</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1707"><ip.session_id>854</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6245760917663574</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.006198883056640625</time_between_pkts_sum><time_between_pkts_avg>0.006198883056640625</time_between_pkts_avg><time_between_pkts_max>0.006198883056640625</time_between_pkts_max><time_between_pkts_min>0.006198883056640625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38101391045096095</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38101391045096095</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>13</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>13</min_tcp_pkts><max_tcp_pkts>13</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1708"><ip.session_id>855</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6245810985565186</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3810131836086092</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3810131836086092</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1709"><ip.session_id>855</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6245861053466797</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3810124567690305</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3810124567690305</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>8383</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>8383</min_tcp_pkts><max_tcp_pkts>8383</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1710"><ip.session_id>856</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.62460994720459</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.02384185791015625</time_between_pkts_sum><time_between_pkts_avg>0.02384185791015625</time_between_pkts_avg><time_between_pkts_max>0.02384185791015625</time_between_pkts_max><time_between_pkts_min>0.02384185791015625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38100899566622326</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38100899566622326</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1711"><ip.session_id>856</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6246159076690674</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3810081304003466</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3810081304003466</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>7025</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>7025</min_tcp_pkts><max_tcp_pkts>7025</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1712"><ip.session_id>857</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6246209144592285</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38100740358004725</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38100740358004725</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1713"><ip.session_id>857</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6246249675750732</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0040531158447265625</time_between_pkts_sum><time_between_pkts_avg>0.0040531158447265625</time_between_pkts_avg><time_between_pkts_max>0.0040531158447265625</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38100681520374075</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38100681520374075</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1658</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1658</min_tcp_pkts><max_tcp_pkts>1658</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1714"><ip.session_id>858</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.624638080596924</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.013113021850585938</time_between_pkts_sum><time_between_pkts_avg>0.013113021850585938</time_between_pkts_avg><time_between_pkts_max>0.013113021850585938</time_between_pkts_max><time_between_pkts_min>0.013113021850585938</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3810049116457874</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3810049116457874</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1715"><ip.session_id>858</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6246440410614014</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3810040463984601</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3810040463984601</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>2200</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>2200</min_tcp_pkts><max_tcp_pkts>2200</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1716"><ip.session_id>859</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6246490478515625</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3810033195937422</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3810033195937422</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1717"><ip.session_id>859</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6246531009674072</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0040531158447265625</time_between_pkts_sum><time_between_pkts_avg>0.0040531158447265625</time_between_pkts_avg><time_between_pkts_max>0.0040531158447265625</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38100273123004913</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38100273123004913</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>981</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>981</min_tcp_pkts><max_tcp_pkts>981</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1718"><ip.session_id>860</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.624742031097412</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.08893013000488281</time_between_pkts_sum><time_between_pkts_avg>0.08893013000488281</time_between_pkts_avg><time_between_pkts_max>0.08893013000488281</time_between_pkts_max><time_between_pkts_min>0.08893013000488281</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38098982229575423</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38098982229575423</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1719"><ip.session_id>860</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.624748945236206</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3809888186887177</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3809888186887177</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>3826</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>3826</min_tcp_pkts><max_tcp_pkts>3826</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1720"><ip.session_id>861</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.624756097793579</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.007152557373046875</time_between_pkts_sum><time_between_pkts_avg>0.007152557373046875</time_between_pkts_avg><time_between_pkts_max>0.007152557373046875</time_between_pkts_max><time_between_pkts_min>0.007152557373046875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3809877804801061</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3809877804801061</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1721"><ip.session_id>861</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6247620582580566</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3809869153105854</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3809869153105854</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>5998</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>5998</min_tcp_pkts><max_tcp_pkts>5998</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1722"><ip.session_id>862</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.624756097793579</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3809877804801061</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3809877804801061</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1723"><ip.session_id>862</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6247689723968506</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38098591171886403</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38098591171886403</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>5906</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>5906</min_tcp_pkts><max_tcp_pkts>5906</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1724"><ip.session_id>863</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6247730255126953</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0040531158447265625</time_between_pkts_sum><time_between_pkts_avg>0.0040531158447265625</time_between_pkts_avg><time_between_pkts_max>0.0040531158447265625</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3809853234089339</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3809853234089339</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1725"><ip.session_id>863</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.62477707862854</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0040531158447265625</time_between_pkts_sum><time_between_pkts_avg>0.0040531158447265625</time_between_pkts_avg><time_between_pkts_max>0.0040531158447265625</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3809847351008206</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3809847351008206</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>52673</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>52673</min_tcp_pkts><max_tcp_pkts>52673</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1726"><ip.session_id>864</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6247920989990234</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.015020370483398438</time_between_pkts_sum><time_between_pkts_avg>0.015020370483398438</time_between_pkts_avg><time_between_pkts_max>0.015020370483398438</time_between_pkts_max><time_between_pkts_min>0.015020370483398438</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38098255491600824</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38098255491600824</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1727"><ip.session_id>864</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.62480092048645</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.008821487426757812</time_between_pkts_sum><time_between_pkts_avg>0.008821487426757812</time_between_pkts_avg><time_between_pkts_max>0.008821487426757812</time_between_pkts_max><time_between_pkts_min>0.008821487426757812</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3809812745016379</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3809812745016379</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>2222</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>2222</min_tcp_pkts><max_tcp_pkts>2222</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1728"><ip.session_id>865</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6247920989990234</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38098255491600824</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38098255491600824</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1729"><ip.session_id>865</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6248059272766113</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38098054778379675</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38098054778379675</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>3690</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>3690</min_tcp_pkts><max_tcp_pkts>3690</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1730"><ip.session_id>866</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.624809980392456</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0040531158447265625</time_between_pkts_sum><time_between_pkts_avg>0.0040531158447265625</time_between_pkts_avg><time_between_pkts_max>0.0040531158447265625</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3809799594904322</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3809799594904322</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1731"><ip.session_id>866</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.624814033508301</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0040531158447265625</time_between_pkts_sum><time_between_pkts_avg>0.0040531158447265625</time_between_pkts_avg><time_between_pkts_max>0.0040531158447265625</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3809793711988844</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3809793711988844</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>2046</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>2046</min_tcp_pkts><max_tcp_pkts>2046</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1732"><ip.session_id>867</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6248199939727783</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38097850606755584</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38097850606755584</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1733"><ip.session_id>867</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.624824047088623</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0040531158447265625</time_between_pkts_sum><time_between_pkts_avg>0.0040531158447265625</time_between_pkts_avg><time_between_pkts_max>0.0040531158447265625</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38097791778049667</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38097791778049667</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>5222</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>5222</min_tcp_pkts><max_tcp_pkts>5222</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1734"><ip.session_id>868</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6249330043792725</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.10895729064941406</time_between_pkts_sum><time_between_pkts_avg>0.10895729064941406</time_between_pkts_avg><time_between_pkts_max>0.10895729064941406</time_between_pkts_max><time_between_pkts_min>0.10895729064941406</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38096210392100033</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38096210392100033</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1735"><ip.session_id>868</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6249399185180664</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3809611004599904</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3809611004599904</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>311</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>311</min_tcp_pkts><max_tcp_pkts>311</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1736"><ip.session_id>869</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6249330043792725</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38096210392100033</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38096210392100033</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1737"><ip.session_id>869</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.624946117401123</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.006198883056640625</time_between_pkts_sum><time_between_pkts_avg>0.006198883056640625</time_between_pkts_avg><time_between_pkts_max>0.006198883056640625</time_between_pkts_max><time_between_pkts_min>0.006198883056640625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.38096020080978604</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.38096020080978604</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>8192</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>8192</min_tcp_pkts><max_tcp_pkts>8192</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1738"><ip.session_id>870</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.625098943710327</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.15282630920410156</time_between_pkts_sum><time_between_pkts_avg>0.15282630920410156</time_between_pkts_avg><time_between_pkts_max>0.15282630920410156</time_between_pkts_max><time_between_pkts_min>0.15282630920410156</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3809380223156828</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3809380223156828</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1739"><ip.session_id>870</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6251039505004883</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3809372957628384</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3809372957628384</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>5000</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>5000</min_tcp_pkts><max_tcp_pkts>5000</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1740"><ip.session_id>871</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6508400440216064</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>25.736093521118164</time_between_pkts_sum><time_between_pkts_avg>25.736093521118164</time_between_pkts_avg><time_between_pkts_max>25.736093521118164</time_between_pkts_max><time_between_pkts_min>25.736093521118164</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37723890668366905</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37723890668366905</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1741"><ip.session_id>871</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6508641242980957</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.023126602172851562</time_between_pkts_sum><time_between_pkts_avg>0.023126602172851562</time_between_pkts_avg><time_between_pkts_max>0.023126602172851562</time_between_pkts_max><time_between_pkts_min>0.023126602172851562</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37723547987009076</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37723547987009076</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>5904</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>5904</min_tcp_pkts><max_tcp_pkts>5904</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1742"><ip.session_id>872</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.650840997695923</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.00095367431640625</time_between_pkts_sum><time_between_pkts_avg>0.00095367431640625</time_between_pkts_avg><time_between_pkts_max>0.00095367431640625</time_between_pkts_max><time_between_pkts_min>0.00095367431640625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3772387709670958</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3772387709670958</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1743"><ip.session_id>872</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.650873899459839</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.009775161743164062</time_between_pkts_sum><time_between_pkts_avg>0.009775161743164062</time_between_pkts_avg><time_between_pkts_max>0.009775161743164062</time_between_pkts_max><time_between_pkts_min>0.009775161743164062</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3772340888051171</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3772340888051171</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>5544</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>5544</min_tcp_pkts><max_tcp_pkts>5544</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1744"><ip.session_id>873</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6564390659332275</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>5.565166473388672</time_between_pkts_sum><time_between_pkts_avg>5.565166473388672</time_between_pkts_avg><time_between_pkts_max>5.565166473388672</time_between_pkts_max><time_between_pkts_min>5.565166473388672</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37644379380811893</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37644379380811893</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1745"><ip.session_id>873</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6564481258392334</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.009059906005859375</time_between_pkts_sum><time_between_pkts_avg>0.009059906005859375</time_between_pkts_avg><time_between_pkts_max>0.009059906005859375</time_between_pkts_max><time_between_pkts_min>0.009059906005859375</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3764425099338527</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3764425099338527</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1059</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1059</min_tcp_pkts><max_tcp_pkts>1059</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1746"><ip.session_id>874</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6565189361572266</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.07081031799316406</time_between_pkts_sum><time_between_pkts_avg>0.07081031799316406</time_between_pkts_avg><time_between_pkts_max>0.07081031799316406</time_between_pkts_max><time_between_pkts_min>0.07081031799316406</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37643247574457145</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37643247574457145</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1747"><ip.session_id>874</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6565260887145996</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.007152557373046875</time_between_pkts_sum><time_between_pkts_avg>0.007152557373046875</time_between_pkts_avg><time_between_pkts_max>0.007152557373046875</time_between_pkts_max><time_between_pkts_min>0.007152557373046875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3764314622198441</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3764314622198441</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1052</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1052</min_tcp_pkts><max_tcp_pkts>1052</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1748"><ip.session_id>875</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6565310955047607</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37643075275578225</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37643075275578225</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1749"><ip.session_id>875</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6565349102020264</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.003814697265625</time_between_pkts_sum><time_between_pkts_avg>0.003814697265625</time_between_pkts_avg><time_between_pkts_max>0.003814697265625</time_between_pkts_max><time_between_pkts_min>0.003814697265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3764302122135301</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3764302122135301</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>2394</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>2394</min_tcp_pkts><max_tcp_pkts>2394</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1750"><ip.session_id>876</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6566050052642822</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.07009506225585938</time_between_pkts_sum><time_between_pkts_avg>0.07009506225585938</time_between_pkts_avg><time_between_pkts_max>0.07009506225585938</time_between_pkts_max><time_between_pkts_min>0.07009506225585938</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37642028002597955</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37642028002597955</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1751"><ip.session_id>876</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.656611919403076</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3764193003488043</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3764193003488043</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>6666</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>6666</min_tcp_pkts><max_tcp_pkts>6666</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1752"><ip.session_id>877</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6566390991210938</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.027179718017578125</time_between_pkts_sum><time_between_pkts_avg>0.027179718017578125</time_between_pkts_avg><time_between_pkts_max>0.027179718017578125</time_between_pkts_max><time_between_pkts_min>0.027179718017578125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37641544925346987</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37641544925346987</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1753"><ip.session_id>877</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.656649112701416</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.010013580322265625</time_between_pkts_sum><time_between_pkts_avg>0.010013580322265625</time_between_pkts_avg><time_between_pkts_max>0.010013580322265625</time_between_pkts_max><time_between_pkts_min>0.010013580322265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37641403044873667</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37641403044873667</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>42510</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>42510</min_tcp_pkts><max_tcp_pkts>42510</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1754"><ip.session_id>878</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6566669940948486</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.017881393432617188</time_between_pkts_sum><time_between_pkts_avg>0.017881393432617188</time_between_pkts_avg><time_between_pkts_max>0.017881393432617188</time_between_pkts_max><time_between_pkts_min>0.017881393432617188</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37641149689545844</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37641149689545844</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1755"><ip.session_id>878</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6566760540008545</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.009059906005859375</time_between_pkts_sum><time_between_pkts_avg>0.009059906005859375</time_between_pkts_avg><time_between_pkts_max>0.009059906005859375</time_between_pkts_max><time_between_pkts_min>0.009059906005859375</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3764102132414818</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3764102132414818</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>5560</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>5560</min_tcp_pkts><max_tcp_pkts>5560</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1756"><ip.session_id>879</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6566669940948486</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37641149689545844</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37641149689545844</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1757"><ip.session_id>879</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.656682014465332</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3764093687370613</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3764093687370613</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>19101</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>19101</min_tcp_pkts><max_tcp_pkts>19101</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1758"><ip.session_id>880</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6566669940948486</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37641149689545844</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37641149689545844</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1759"><ip.session_id>880</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.656687021255493</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37640865935627654</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37640865935627654</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>3030</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>3030</min_tcp_pkts><max_tcp_pkts>3030</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1760"><ip.session_id>881</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.656691074371338</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0040531158447265625</time_between_pkts_sum><time_between_pkts_avg>0.0040531158447265625</time_between_pkts_avg><time_between_pkts_max>0.0040531158447265625</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37640808509759965</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37640808509759965</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1761"><ip.session_id>881</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6566970348358154</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37640724060272845</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37640724060272845</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1087</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1087</min_tcp_pkts><max_tcp_pkts>1087</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1762"><ip.session_id>882</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6567020416259766</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37640653122996504</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37640653122996504</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1763"><ip.session_id>882</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6567070484161377</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37640582185987537</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37640582185987537</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>6580</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>6580</min_tcp_pkts><max_tcp_pkts>6580</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1764"><ip.session_id>883</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6567130088806152</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37640497737515954</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37640497737515954</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1765"><ip.session_id>883</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.65671706199646</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0040531158447265625</time_between_pkts_sum><time_between_pkts_avg>0.0040531158447265625</time_between_pkts_avg><time_between_pkts_max>0.0040531158447265625</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3764044031277172</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3764044031277172</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1183</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1183</min_tcp_pkts><max_tcp_pkts>1183</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1766"><ip.session_id>884</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.656744956970215</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.027894973754882812</time_between_pkts_sum><time_between_pkts_avg>0.027894973754882812</time_between_pkts_avg><time_between_pkts_max>0.027894973754882812</time_between_pkts_max><time_between_pkts_min>0.027894973754882812</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3764004510016695</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3764004510016695</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1767"><ip.session_id>884</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.656752109527588</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.007152557373046875</time_between_pkts_sum><time_between_pkts_avg>0.007152557373046875</time_between_pkts_avg><time_between_pkts_max>0.007152557373046875</time_between_pkts_max><time_between_pkts_min>0.007152557373046875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3763994376493845</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3763994376493845</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>49400</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>49400</min_tcp_pkts><max_tcp_pkts>49400</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1768"><ip.session_id>885</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.656757116317749</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37639872830603144</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37639872830603144</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1769"><ip.session_id>885</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6567609310150146</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.003814697265625</time_between_pkts_sum><time_between_pkts_avg>0.003814697265625</time_between_pkts_avg><time_between_pkts_max>0.003814697265625</time_between_pkts_max><time_between_pkts_min>0.003814697265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37639818785574747</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37639818785574747</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>6565</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>6565</min_tcp_pkts><max_tcp_pkts>6565</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1770"><ip.session_id>886</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.656783103942871</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.022172927856445312</time_between_pkts_sum><time_between_pkts_avg>0.022172927856445312</time_between_pkts_avg><time_between_pkts_max>0.022172927856445312</time_between_pkts_max><time_between_pkts_min>0.022172927856445312</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3763950465191994</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3763950465191994</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1771"><ip.session_id>886</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6567890644073486</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37639420208283286</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37639420208283286</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>2001</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>2001</min_tcp_pkts><max_tcp_pkts>2001</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1772"><ip.session_id>887</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.656795024871826</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3763933576502552</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3763933576502552</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1773"><ip.session_id>887</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6568009853363037</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37639251322146655</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37639251322146655</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1126</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1126</min_tcp_pkts><max_tcp_pkts>1126</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1774"><ip.session_id>888</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.656795024871826</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3763933576502552</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3763933576502552</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1775"><ip.session_id>888</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6568069458007812</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37639166879646674</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37639166879646674</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1108</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1108</min_tcp_pkts><max_tcp_pkts>1108</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1776"><ip.session_id>889</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6568291187286377</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.022172927856445312</time_between_pkts_sum><time_between_pkts_avg>0.022172927856445312</time_between_pkts_avg><time_between_pkts_max>0.022172927856445312</time_between_pkts_max><time_between_pkts_min>0.022172927856445312</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3763885275687306</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3763885275687306</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1777"><ip.session_id>889</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.656834125518799</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3763878182664981</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3763878182664981</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>5280</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>5280</min_tcp_pkts><max_tcp_pkts>5280</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1778"><ip.session_id>890</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.656913995742798</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.07987022399902344</time_between_pkts_sum><time_between_pkts_avg>0.07987022399902344</time_between_pkts_avg><time_between_pkts_max>0.07987022399902344</time_between_pkts_max><time_between_pkts_min>0.07987022399902344</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37637650356854263</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37637650356854263</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1779"><ip.session_id>890</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6569199562072754</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3763756592153755</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3763756592153755</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>146</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>146</min_tcp_pkts><max_tcp_pkts>146</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1780"><ip.session_id>891</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6569249629974365</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3763749499616429</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3763749499616429</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1781"><ip.session_id>891</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6569290161132812</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0040531158447265625</time_between_pkts_sum><time_between_pkts_avg>0.0040531158447265625</time_between_pkts_avg><time_between_pkts_max>0.0040531158447265625</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3763743758058171</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3763743758058171</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>2002</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>2002</min_tcp_pkts><max_tcp_pkts>2002</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1782"><ip.session_id>892</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.656960964202881</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.031948089599609375</time_between_pkts_sum><time_between_pkts_avg>0.031948089599609375</time_between_pkts_avg><time_between_pkts_max>0.031948089599609375</time_between_pkts_max><time_between_pkts_min>0.031948089599609375</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37636985016827734</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37636985016827734</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1783"><ip.session_id>892</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6569700241088867</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.009059906005859375</time_between_pkts_sum><time_between_pkts_avg>0.009059906005859375</time_between_pkts_avg><time_between_pkts_max>0.009059906005859375</time_between_pkts_max><time_between_pkts_min>0.009059906005859375</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37636856679833525</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37636856679833525</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>6059</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>6059</min_tcp_pkts><max_tcp_pkts>6059</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1784"><ip.session_id>893</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.656960964202881</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37636985016827734</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37636985016827734</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1785"><ip.session_id>893</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6569759845733643</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37636772248077804</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37636772248077804</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>6547</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>6547</min_tcp_pkts><max_tcp_pkts>6547</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1786"><ip.session_id>894</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.656960964202881</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37636985016827734</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37636985016827734</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1787"><ip.session_id>894</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6569809913635254</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3763670132569575</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3763670132569575</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>8291</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>8291</min_tcp_pkts><max_tcp_pkts>8291</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1788"><ip.session_id>895</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.656996011734009</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.015020370483398438</time_between_pkts_sum><time_between_pkts_avg>0.015020370483398438</time_between_pkts_avg><time_between_pkts_max>0.015020370483398438</time_between_pkts_max><time_between_pkts_min>0.015020370483398438</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37636488560153314</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37636488560153314</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1789"><ip.session_id>895</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6570050716400146</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.009059906005859375</time_between_pkts_sum><time_between_pkts_avg>0.009059906005859375</time_between_pkts_avg><time_between_pkts_max>0.009059906005859375</time_between_pkts_max><time_between_pkts_min>0.009059906005859375</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37636360226544774</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37636360226544774</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>2040</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>2040</min_tcp_pkts><max_tcp_pkts>2040</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1790"><ip.session_id>896</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.656996011734009</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37636488560153314</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37636488560153314</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1791"><ip.session_id>896</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6570119857788086</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3763626228832707</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3763626228832707</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>84</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>84</min_tcp_pkts><max_tcp_pkts>84</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1792"><ip.session_id>897</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.657015085220337</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0030994415283203125</time_between_pkts_sum><time_between_pkts_avg>0.0030994415283203125</time_between_pkts_avg><time_between_pkts_max>0.0030994415283203125</time_between_pkts_max><time_between_pkts_min>0.0030994415283203125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37636218385153564</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37636218385153564</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1793"><ip.session_id>897</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6570188999176025</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.003814697265625</time_between_pkts_sum><time_between_pkts_avg>0.003814697265625</time_between_pkts_avg><time_between_pkts_max>0.003814697265625</time_between_pkts_max><time_between_pkts_min>0.003814697265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37636164350619083</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37636164350619083</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>44442</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>44442</min_tcp_pkts><max_tcp_pkts>44442</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1794"><ip.session_id>898</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.657089948654175</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.07104873657226562</time_between_pkts_sum><time_between_pkts_avg>0.07104873657226562</time_between_pkts_avg><time_between_pkts_max>0.07104873657226562</time_between_pkts_max><time_between_pkts_min>0.07104873657226562</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37635157985769485</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37635157985769485</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1795"><ip.session_id>898</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.657097101211548</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.007152557373046875</time_between_pkts_sum><time_between_pkts_avg>0.007152557373046875</time_between_pkts_avg><time_between_pkts_max>0.007152557373046875</time_between_pkts_max><time_between_pkts_min>0.007152557373046875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37635056676853595</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37635056676853595</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1875</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1875</min_tcp_pkts><max_tcp_pkts>1875</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1796"><ip.session_id>899</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.657089948654175</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37635157985769485</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37635157985769485</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1797"><ip.session_id>899</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.657104015350342</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3763495874542002</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3763495874542002</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>5810</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>5810</min_tcp_pkts><max_tcp_pkts>5810</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1798"><ip.session_id>900</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6571080684661865</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0040531158447265625</time_between_pkts_sum><time_between_pkts_avg>0.0040531158447265625</time_between_pkts_avg><time_between_pkts_max>0.0040531158447265625</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3763490133757522</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3763490133757522</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1799"><ip.session_id>900</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6571121215820312</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0040531158447265625</time_between_pkts_sum><time_between_pkts_avg>0.0040531158447265625</time_between_pkts_avg><time_between_pkts_max>0.0040531158447265625</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37634843929905565</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37634843929905565</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>2605</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>2605</min_tcp_pkts><max_tcp_pkts>2605</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1800"><ip.session_id>901</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6571550369262695</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.04291534423828125</time_between_pkts_sum><time_between_pkts_avg>0.04291534423828125</time_between_pkts_avg><time_between_pkts_max>0.04291534423828125</time_between_pkts_max><time_between_pkts_min>0.04291534423828125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3763423609473593</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3763423609473593</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1801"><ip.session_id>901</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6571640968322754</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.009059906005859375</time_between_pkts_sum><time_between_pkts_avg>0.009059906005859375</time_between_pkts_avg><time_between_pkts_max>0.009059906005859375</time_between_pkts_max><time_between_pkts_min>0.009059906005859375</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3763410777648791</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3763410777648791</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>211</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>211</min_tcp_pkts><max_tcp_pkts>211</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1802"><ip.session_id>902</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6571550369262695</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3763423609473593</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3763423609473593</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1803"><ip.session_id>902</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.657170057296753</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37634023357065094</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37634023357065094</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>8000</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>8000</min_tcp_pkts><max_tcp_pkts>8000</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1804"><ip.session_id>903</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.657172918319702</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.00286102294921875</time_between_pkts_sum><time_between_pkts_avg>0.00286102294921875</time_between_pkts_avg><time_between_pkts_max>0.00286102294921875</time_between_pkts_max><time_between_pkts_min>0.00286102294921875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3763398283587667</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3763398283587667</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1805"><ip.session_id>903</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6571779251098633</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.376339119240069</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.376339119240069</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>8081</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>8081</min_tcp_pkts><max_tcp_pkts>8081</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1806"><ip.session_id>904</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6572299003601074</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.051975250244140625</time_between_pkts_sum><time_between_pkts_avg>0.051975250244140625</time_between_pkts_avg><time_between_pkts_max>0.051975250244140625</time_between_pkts_max><time_between_pkts_min>0.051975250244140625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37633175807049296</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37633175807049296</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1807"><ip.session_id>904</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.657238006591797</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.008106231689453125</time_between_pkts_sum><time_between_pkts_avg>0.008106231689453125</time_between_pkts_avg><time_between_pkts_max>0.008106231689453125</time_between_pkts_max><time_between_pkts_min>0.008106231689453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3763306100241322</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3763306100241322</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1594</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1594</min_tcp_pkts><max_tcp_pkts>1594</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1808"><ip.session_id>905</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6572299003601074</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37633175807049296</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37633175807049296</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1809"><ip.session_id>905</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6572439670562744</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3763297658768651</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3763297658768651</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>15742</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>15742</min_tcp_pkts><max_tcp_pkts>15742</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1810"><ip.session_id>906</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.657274007797241</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.030040740966796875</time_between_pkts_sum><time_between_pkts_avg>0.030040740966796875</time_between_pkts_avg><time_between_pkts_max>0.030040740966796875</time_between_pkts_max><time_between_pkts_min>0.030040740966796875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37632551143227955</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37632551143227955</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1811"><ip.session_id>906</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6572799682617188</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37632466730788555</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37632466730788555</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>9100</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>9100</min_tcp_pkts><max_tcp_pkts>9100</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1812"><ip.session_id>907</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.657310962677002</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.030994415283203125</time_between_pkts_sum><time_between_pkts_avg>0.030994415283203125</time_between_pkts_avg><time_between_pkts_max>0.030994415283203125</time_between_pkts_max><time_between_pkts_min>0.030994415283203125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3763202779220802</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3763202779220802</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1813"><ip.session_id>907</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.657318115234375</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.007152557373046875</time_between_pkts_sum><time_between_pkts_avg>0.007152557373046875</time_between_pkts_avg><time_between_pkts_max>0.007152557373046875</time_between_pkts_max><time_between_pkts_min>0.007152557373046875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37631926500143553</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37631926500143553</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>3372</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>3372</min_tcp_pkts><max_tcp_pkts>3372</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1814"><ip.session_id>908</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.657323122024536</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3763185559602287</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3763185559602287</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1815"><ip.session_id>908</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6573281288146973</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3763178469216937</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3763178469216937</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1145</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1145</min_tcp_pkts><max_tcp_pkts>1145</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1816"><ip.session_id>909</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.657351016998291</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.02288818359375</time_between_pkts_sum><time_between_pkts_avg>0.02288818359375</time_between_pkts_avg><time_between_pkts_max>0.02288818359375</time_between_pkts_max><time_between_pkts_min>0.02288818359375</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37631460563670166</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37631460563670166</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1817"><ip.session_id>909</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.657360076904297</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.009059906005859375</time_between_pkts_sum><time_between_pkts_avg>0.009059906005859375</time_between_pkts_avg><time_between_pkts_max>0.009059906005859375</time_between_pkts_max><time_between_pkts_min>0.009059906005859375</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37631332264348394</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37631332264348394</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>34571</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>34571</min_tcp_pkts><max_tcp_pkts>34571</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1818"><ip.session_id>910</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.657351016998291</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37631460563670166</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37631460563670166</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1819"><ip.session_id>910</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6573750972747803</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.015020370483398438</time_between_pkts_sum><time_between_pkts_avg>0.015020370483398438</time_between_pkts_avg><time_between_pkts_max>0.015020370483398438</time_between_pkts_max><time_between_pkts_min>0.015020370483398438</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3763111955950557</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3763111955950557</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>7100</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>7100</min_tcp_pkts><max_tcp_pkts>7100</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1820"><ip.session_id>911</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.657351016998291</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37631460563670166</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37631460563670166</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1821"><ip.session_id>911</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6573801040649414</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3763104865842564</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3763104865842564</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1719</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1719</min_tcp_pkts><max_tcp_pkts>1719</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1822"><ip.session_id>912</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.657392978668213</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.012874603271484375</time_between_pkts_sum><time_between_pkts_avg>0.012874603271484375</time_between_pkts_avg><time_between_pkts_max>0.012874603271484375</time_between_pkts_max><time_between_pkts_min>0.012874603271484375</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3763086634258976</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3763086634258976</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1823"><ip.session_id>912</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6573989391326904</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37630781937708435</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37630781937708435</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1001</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1001</min_tcp_pkts><max_tcp_pkts>1001</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1824"><ip.session_id>913</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.657392978668213</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3763086634258976</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3763086634258976</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1825"><ip.session_id>913</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.657404899597168</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3763069753320574</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3763069753320574</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>800</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>800</min_tcp_pkts><max_tcp_pkts>800</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1826"><ip.session_id>914</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6575169563293457</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.11205673217773438</time_between_pkts_sum><time_between_pkts_avg>0.11205673217773438</time_between_pkts_avg><time_between_pkts_max>0.11205673217773438</time_between_pkts_max><time_between_pkts_min>0.11205673217773438</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3762911079902326</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3762911079902326</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1827"><ip.session_id>914</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.657526969909668</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.010013580322265625</time_between_pkts_sum><time_between_pkts_avg>0.010013580322265625</time_between_pkts_avg><time_between_pkts_max>0.010013580322265625</time_between_pkts_max><time_between_pkts_min>0.010013580322265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3762896901226899</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3762896901226899</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>50300</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>50300</min_tcp_pkts><max_tcp_pkts>50300</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1828"><ip.session_id>915</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6575169563293457</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3762911079902326</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3762911079902326</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1829"><ip.session_id>915</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6575350761413574</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.008106231689453125</time_between_pkts_sum><time_between_pkts_avg>0.008106231689453125</time_between_pkts_avg><time_between_pkts_max>0.008106231689453125</time_between_pkts_max><time_between_pkts_min>0.008106231689453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37628854233298137</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37628854233298137</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>6689</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>6689</min_tcp_pkts><max_tcp_pkts>6689</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1830"><ip.session_id>916</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6575419902801514</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3762875633414103</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3762875633414103</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1831"><ip.session_id>916</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.65755295753479</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.010967254638671875</time_between_pkts_sum><time_between_pkts_avg>0.010967254638671875</time_between_pkts_avg><time_between_pkts_max>0.010967254638671875</time_between_pkts_max><time_between_pkts_min>0.010967254638671875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37628601046867716</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37628601046867716</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1068</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1068</min_tcp_pkts><max_tcp_pkts>1068</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1832"><ip.session_id>917</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6575419902801514</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3762875633414103</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3762875633414103</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1833"><ip.session_id>917</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6575610637664795</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.008106231689453125</time_between_pkts_sum><time_between_pkts_avg>0.008106231689453125</time_between_pkts_avg><time_between_pkts_max>0.008106231689453125</time_between_pkts_max><time_between_pkts_min>0.008106231689453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3762848627014165</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3762848627014165</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>2068</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>2068</min_tcp_pkts><max_tcp_pkts>2068</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1834"><ip.session_id>918</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6575419902801514</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3762875633414103</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3762875633414103</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1835"><ip.session_id>918</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.657565116882324</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0040531158447265625</time_between_pkts_sum><time_between_pkts_avg>0.0040531158447265625</time_between_pkts_avg><time_between_pkts_max>0.0040531158447265625</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3762842888204118</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3762842888204118</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1914</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1914</min_tcp_pkts><max_tcp_pkts>1914</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1836"><ip.session_id>919</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6575679779052734</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.00286102294921875</time_between_pkts_sum><time_between_pkts_avg>0.00286102294921875</time_between_pkts_avg><time_between_pkts_max>0.00286102294921875</time_between_pkts_max><time_between_pkts_min>0.00286102294921875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3762838837289919</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3762838837289919</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1837"><ip.session_id>919</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6575748920440674</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37628290476166126</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37628290476166126</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>6100</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>6100</min_tcp_pkts><max_tcp_pkts>6100</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1838"><ip.session_id>920</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6575679779052734</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3762838837289919</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3762838837289919</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1839"><ip.session_id>920</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6575798988342285</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3762821958574638</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3762821958574638</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>2033</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>2033</min_tcp_pkts><max_tcp_pkts>2033</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1840"><ip.session_id>921</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6575679779052734</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3762838837289919</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3762838837289919</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1841"><ip.session_id>921</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.657582998275757</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0030994415283203125</time_between_pkts_sum><time_between_pkts_avg>0.0030994415283203125</time_between_pkts_avg><time_between_pkts_max>0.0030994415283203125</time_between_pkts_max><time_between_pkts_min>0.0030994415283203125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3762817570133468</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3762817570133468</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1086</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1086</min_tcp_pkts><max_tcp_pkts>1086</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1842"><ip.session_id>922</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6576809883117676</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.09799003601074219</time_between_pkts_sum><time_between_pkts_avg>0.09799003601074219</time_between_pkts_avg><time_between_pkts_max>0.09799003601074219</time_between_pkts_max><time_between_pkts_min>0.09799003601074219</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.376267883315532</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.376267883315532</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1843"><ip.session_id>922</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.657694101333618</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.013113021850585938</time_between_pkts_sum><time_between_pkts_avg>0.013113021850585938</time_between_pkts_avg><time_between_pkts_max>0.013113021850585938</time_between_pkts_max><time_between_pkts_min>0.013113021850585938</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3762660268155785</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3762660268155785</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>4125</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>4125</min_tcp_pkts><max_tcp_pkts>4125</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1844"><ip.session_id>923</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6576809883117676</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.376267883315532</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.376267883315532</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1845"><ip.session_id>923</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.657701015472412</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3762650479411612</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3762650479411612</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1148</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1148</min_tcp_pkts><max_tcp_pkts>1148</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1846"><ip.session_id>924</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6576809883117676</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.376267883315532</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.376267883315532</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1847"><ip.session_id>924</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6577041149139404</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0030994415283203125</time_between_pkts_sum><time_between_pkts_avg>0.0030994415283203125</time_between_pkts_avg><time_between_pkts_max>0.0030994415283203125</time_between_pkts_max><time_between_pkts_min>0.0030994415283203125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37626460913704124</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37626460913704124</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>9099</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>9099</min_tcp_pkts><max_tcp_pkts>9099</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1848"><ip.session_id>925</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6576809883117676</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.376267883315532</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.376267883315532</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1849"><ip.session_id>925</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6577091217041016</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37626390030177875</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37626390030177875</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>10003</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>10003</min_tcp_pkts><max_tcp_pkts>10003</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1850"><ip.session_id>926</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6609671115875244</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>3.2579898834228516</time_between_pkts_sum><time_between_pkts_avg>3.2579898834228516</time_between_pkts_avg><time_between_pkts_max>3.2579898834228516</time_between_pkts_max><time_between_pkts_min>3.2579898834228516</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37580321667463346</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37580321667463346</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1851"><ip.session_id>926</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6609749794006348</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.007867813110351562</time_between_pkts_sum><time_between_pkts_avg>0.007867813110351562</time_between_pkts_avg><time_between_pkts_max>0.007867813110351562</time_between_pkts_max><time_between_pkts_min>0.007867813110351562</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37580210552195525</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37580210552195525</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>2009</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>2009</min_tcp_pkts><max_tcp_pkts>2009</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1852"><ip.session_id>927</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.661068916320801</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.09393692016601562</time_between_pkts_sum><time_between_pkts_avg>0.09393692016601562</time_between_pkts_avg><time_between_pkts_max>0.09393692016601562</time_between_pkts_max><time_between_pkts_min>0.09393692016601562</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3757888395399402</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3757888395399402</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1853"><ip.session_id>927</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.661094903945923</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.025987625122070312</time_between_pkts_sum><time_between_pkts_avg>0.025987625122070312</time_between_pkts_avg><time_between_pkts_max>0.025987625122070312</time_between_pkts_max><time_between_pkts_min>0.025987625122070312</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3757851696747759</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3757851696747759</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>9200</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>9200</min_tcp_pkts><max_tcp_pkts>9200</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1854"><ip.session_id>928</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.661068916320801</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3757888395399402</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3757888395399402</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1855"><ip.session_id>928</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6611061096191406</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.011205673217773438</time_between_pkts_sum><time_between_pkts_avg>0.011205673217773438</time_between_pkts_avg><time_between_pkts_max>0.011205673217773438</time_between_pkts_max><time_between_pkts_min>0.011205673217773438</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3757835872779687</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3757835872779687</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>22939</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>22939</min_tcp_pkts><max_tcp_pkts>22939</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1856"><ip.session_id>929</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.661112070083618</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3757827455829689</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3757827455829689</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1857"><ip.session_id>929</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.661121129989624</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.009059906005859375</time_between_pkts_sum><time_between_pkts_avg>0.009059906005859375</time_between_pkts_avg><time_between_pkts_max>0.009059906005859375</time_between_pkts_max><time_between_pkts_min>0.009059906005859375</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37578146621379055</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37578146621379055</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1309</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1309</min_tcp_pkts><max_tcp_pkts>1309</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1858"><ip.session_id>930</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.661112070083618</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3757827455829689</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3757827455829689</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1859"><ip.session_id>930</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6611320972442627</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.010967254638671875</time_between_pkts_sum><time_between_pkts_avg>0.010967254638671875</time_between_pkts_avg><time_between_pkts_max>0.010967254638671875</time_between_pkts_max><time_between_pkts_min>0.010967254638671875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3757799175153878</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3757799175153878</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1149</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1149</min_tcp_pkts><max_tcp_pkts>1149</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1860"><ip.session_id>931</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.661137104034424</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3757792105051436</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3757792105051436</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1861"><ip.session_id>931</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.661144971847534</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.007867813110351562</time_between_pkts_sum><time_between_pkts_avg>0.007867813110351562</time_between_pkts_avg><time_between_pkts_max>0.007867813110351562</time_between_pkts_max><time_between_pkts_min>0.007867813110351562</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37577809949442065</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37577809949442065</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1947</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1947</min_tcp_pkts><max_tcp_pkts>1947</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1862"><ip.session_id>932</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6611499786376953</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3757773924910175</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3757773924910175</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1863"><ip.session_id>932</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6611568927764893</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3757764161573581</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3757764161573581</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1123</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1123</min_tcp_pkts><max_tcp_pkts>1123</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1864"><ip.session_id>933</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6611640453338623</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.007152557373046875</time_between_pkts_sum><time_between_pkts_avg>0.007152557373046875</time_between_pkts_avg><time_between_pkts_max>0.007152557373046875</time_between_pkts_max><time_between_pkts_min>0.007152557373046875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3757754061623596</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3757754061623596</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1865"><ip.session_id>933</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.66117000579834</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37577456450400815</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37577456450400815</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>16080</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>16080</min_tcp_pkts><max_tcp_pkts>16080</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1866"><ip.session_id>934</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.661194086074829</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.024080276489257812</time_between_pkts_sum><time_between_pkts_avg>0.024080276489257812</time_between_pkts_avg><time_between_pkts_max>0.024080276489257812</time_between_pkts_max><time_between_pkts_min>0.024080276489257812</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37577116424265244</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37577116424265244</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1867"><ip.session_id>934</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6612000465393066</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3757703226033029</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3757703226033029</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>8022</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>8022</min_tcp_pkts><max_tcp_pkts>8022</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1868"><ip.session_id>935</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6612601280212402</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.06008148193359375</time_between_pkts_sum><time_between_pkts_avg>0.06008148193359375</time_between_pkts_avg><time_between_pkts_max>0.06008148193359375</time_between_pkts_max><time_between_pkts_min>0.06008148193359375</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3757618390891921</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3757618390891921</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1869"><ip.session_id>935</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.661267042160034</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3757608628363517</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3757608628363517</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>5903</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>5903</min_tcp_pkts><max_tcp_pkts>5903</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1870"><ip.session_id>936</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6612601280212402</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3757618390891921</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3757618390891921</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1871"><ip.session_id>936</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.661273956298828</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37575988658858406</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37575988658858406</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>14442</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>14442</min_tcp_pkts><max_tcp_pkts>14442</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1872"><ip.session_id>937</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6619620323181152</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.6880760192871094</time_between_pkts_sum><time_between_pkts_avg>0.6880760192871094</time_between_pkts_avg><time_between_pkts_max>0.6880760192871094</time_between_pkts_max><time_between_pkts_min>0.6880760192871094</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37566275846886155</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37566275846886155</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1873"><ip.session_id>937</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6619670391082764</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37566205189940544</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37566205189940544</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>61900</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>61900</min_tcp_pkts><max_tcp_pkts>61900</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1874"><ip.session_id>938</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6620631217956543</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.09608268737792969</time_between_pkts_sum><time_between_pkts_avg>0.09608268737792969</time_between_pkts_avg><time_between_pkts_max>0.09608268737792969</time_between_pkts_max><time_between_pkts_min>0.09608268737792969</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37564849300998737</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37564849300998737</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1875"><ip.session_id>938</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6620681285858154</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3756477864941929</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3756477864941929</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>10082</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>10082</min_tcp_pkts><max_tcp_pkts>10082</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1876"><ip.session_id>939</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6621201038360596</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.051975250244140625</time_between_pkts_sum><time_between_pkts_avg>0.051975250244140625</time_between_pkts_avg><time_between_pkts_max>0.051975250244140625</time_between_pkts_max><time_between_pkts_min>0.051975250244140625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.375640452344363</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.375640452344363</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1877"><ip.session_id>939</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6621270179748535</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3756394767221607</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3756394767221607</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>44176</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>44176</min_tcp_pkts><max_tcp_pkts>44176</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1878"><ip.session_id>940</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6621310710906982</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0040531158447265625</time_between_pkts_sum><time_between_pkts_avg>0.0040531158447265625</time_between_pkts_avg><time_between_pkts_max>0.0040531158447265625</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3756389048080534</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3756389048080534</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1879"><ip.session_id>940</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.662137031555176</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3756380637610592</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3756380637610592</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>83</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>83</min_tcp_pkts><max_tcp_pkts>83</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1880"><ip.session_id>941</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6621410846710205</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0040531158447265625</time_between_pkts_sum><time_between_pkts_avg>0.0040531158447265625</time_between_pkts_avg><time_between_pkts_max>0.0040531158447265625</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3756374918512544</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3756374918512544</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1881"><ip.session_id>941</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.662147045135498</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37563665081058734</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37563665081058734</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>5555</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>5555</min_tcp_pkts><max_tcp_pkts>5555</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1882"><ip.session_id>942</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6621410846710205</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3756374918512544</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3756374918512544</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1883"><ip.session_id>942</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6621649265289307</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.017881393432617188</time_between_pkts_sum><time_between_pkts_avg>0.017881393432617188</time_between_pkts_avg><time_between_pkts_max>0.017881393432617188</time_between_pkts_max><time_between_pkts_min>0.017881393432617188</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3756341277111828</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3756341277111828</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>3017</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>3017</min_tcp_pkts><max_tcp_pkts>3017</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1884"><ip.session_id>943</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6621689796447754</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0040531158447265625</time_between_pkts_sum><time_between_pkts_avg>0.0040531158447265625</time_between_pkts_avg><time_between_pkts_max>0.0040531158447265625</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3756335558133632</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3756335558133632</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1885"><ip.session_id>943</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6621739864349365</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.375632849353755</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.375632849353755</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>5859</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>5859</min_tcp_pkts><max_tcp_pkts>5859</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1886"><ip.session_id>944</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.662240982055664</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.06699562072753906</time_between_pkts_sum><time_between_pkts_avg>0.06699562072753906</time_between_pkts_avg><time_between_pkts_max>0.06699562072753906</time_between_pkts_max><time_between_pkts_min>0.06699562072753906</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3756233965070452</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3756233965070452</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1887"><ip.session_id>944</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.662245988845825</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3756226900856499</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3756226900856499</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>416</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>416</min_tcp_pkts><max_tcp_pkts>416</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1888"><ip.session_id>945</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.662252902984619</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3756217145557104</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3756217145557104</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1889"><ip.session_id>945</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6622579097747803</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37562100814064153</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37562100814064153</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>55056</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>55056</min_tcp_pkts><max_tcp_pkts>55056</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1890"><ip.session_id>946</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6622719764709473</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.014066696166992188</time_between_pkts_sum><time_between_pkts_avg>0.014066696166992188</time_between_pkts_avg><time_between_pkts_max>0.014066696166992188</time_between_pkts_max><time_between_pkts_min>0.014066696166992188</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3756190234649051</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3756190234649051</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1891"><ip.session_id>946</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.662277936935425</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3756181825069362</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3756181825069362</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>5850</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>5850</min_tcp_pkts><max_tcp_pkts>5850</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1892"><ip.session_id>947</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.662282943725586</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3756174761051524</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3756174761051524</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1893"><ip.session_id>947</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.662287950515747</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37561676970602553</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37561676970602553</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>10617</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>10617</min_tcp_pkts><max_tcp_pkts>10617</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1894"><ip.session_id>948</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6623010635375977</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.013113021850585938</time_between_pkts_sum><time_between_pkts_avg>0.013113021850585938</time_between_pkts_avg><time_between_pkts_max>0.013113021850585938</time_between_pkts_max><time_between_pkts_min>0.013113021850585938</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37561491962566607</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37561491962566607</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1895"><ip.session_id>948</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.662308931350708</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.007867813110351562</time_between_pkts_sum><time_between_pkts_avg>0.007867813110351562</time_between_pkts_avg><time_between_pkts_max>0.007867813110351562</time_between_pkts_max><time_between_pkts_min>0.007867813110351562</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37561380958619833</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37561380958619833</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1047</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1047</min_tcp_pkts><max_tcp_pkts>1047</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1896"><ip.session_id>949</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6623010635375977</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37561491962566607</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37561491962566607</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1897"><ip.session_id>949</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6623148918151855</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3756129686515755</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3756129686515755</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>15004</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>15004</min_tcp_pkts><max_tcp_pkts>15004</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1898"><ip.session_id>950</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6623189449310303</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0040531158447265625</time_between_pkts_sum><time_between_pkts_avg>0.0040531158447265625</time_between_pkts_avg><time_between_pkts_max>0.0040531158447265625</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3756123968181828</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3756123968181828</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1899"><ip.session_id>950</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.662322998046875</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0040531158447265625</time_between_pkts_sum><time_between_pkts_avg>0.0040531158447265625</time_between_pkts_avg><time_between_pkts_max>0.0040531158447265625</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37561182498653123</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37561182498653123</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>144</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>144</min_tcp_pkts><max_tcp_pkts>144</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1900"><ip.session_id>951</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6623411178588867</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.01811981201171875</time_between_pkts_sum><time_between_pkts_avg>0.01811981201171875</time_between_pkts_avg><time_between_pkts_max>0.01811981201171875</time_between_pkts_max><time_between_pkts_min>0.01811981201171875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3756092685839679</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3756092685839679</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1901"><ip.session_id>951</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.662346124649048</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3756085622157114</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3756085622157114</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>65129</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>65129</min_tcp_pkts><max_tcp_pkts>65129</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1902"><ip.session_id>952</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6623709201812744</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0247955322265625</time_between_pkts_sum><time_between_pkts_avg>0.0247955322265625</time_between_pkts_avg><time_between_pkts_max>0.0247955322265625</time_between_pkts_max><time_between_pkts_min>0.0247955322265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3756050640501709</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3756050640501709</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1903"><ip.session_id>952</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.662382125854492</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.010013580322265625</time_between_pkts_sum><time_between_pkts_avg>0.010013580322265625</time_between_pkts_avg><time_between_pkts_max>0.010013580322265625</time_between_pkts_max><time_between_pkts_min>0.010013580322265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37560348316981346</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37560348316981346</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1152</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1152</min_tcp_pkts><max_tcp_pkts>1152</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1904"><ip.session_id>953</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.66237211227417</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0011920928955078125</time_between_pkts_sum><time_between_pkts_avg>0.0011920928955078125</time_between_pkts_avg><time_between_pkts_max>0.0011920928955078125</time_between_pkts_max><time_between_pkts_min>0.0011920928955078125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37560489587077694</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37560489587077694</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1905"><ip.session_id>953</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.662386894226074</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.00476837158203125</time_between_pkts_sum><time_between_pkts_avg>0.00476837158203125</time_between_pkts_avg><time_between_pkts_max>0.00476837158203125</time_between_pkts_max><time_between_pkts_min>0.00476837158203125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.375602810458804</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.375602810458804</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>8084</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>8084</min_tcp_pkts><max_tcp_pkts>8084</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1906"><ip.session_id>954</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.66237211227417</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37560489587077694</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37560489587077694</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1907"><ip.session_id>954</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6623919010162354</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37560210411483747</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37560210411483747</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1974</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1974</min_tcp_pkts><max_tcp_pkts>1974</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1908"><ip.session_id>955</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.66237211227417</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37560489587077694</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37560489587077694</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1909"><ip.session_id>955</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6623950004577637</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0030994415283203125</time_between_pkts_sum><time_between_pkts_avg>0.0030994415283203125</time_between_pkts_avg><time_between_pkts_max>0.0030994415283203125</time_between_pkts_max><time_between_pkts_min>0.0030994415283203125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.375601666855618</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.375601666855618</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>8021</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>8021</min_tcp_pkts><max_tcp_pkts>8021</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1910"><ip.session_id>956</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6822750568389893</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>19.880056381225586</time_between_pkts_sum><time_between_pkts_avg>19.880056381225586</time_between_pkts_avg><time_between_pkts_max>19.880056381225586</time_between_pkts_max><time_between_pkts_min>19.880056381225586</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37281784261845285</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37281784261845285</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1911"><ip.session_id>956</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6822900772094727</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.015020370483398438</time_between_pkts_sum><time_between_pkts_avg>0.015020370483398438</time_between_pkts_avg><time_between_pkts_max>0.015020370483398438</time_between_pkts_max><time_between_pkts_min>0.015020370483398438</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37281575490162966</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37281575490162966</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>4002</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>4002</min_tcp_pkts><max_tcp_pkts>4002</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1912"><ip.session_id>957</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6822750568389893</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37281784261845285</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37281784261845285</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1913"><ip.session_id>957</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.682297945022583</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.007867813110351562</time_between_pkts_sum><time_between_pkts_avg>0.007867813110351562</time_between_pkts_avg><time_between_pkts_max>0.007867813110351562</time_between_pkts_max><time_between_pkts_min>0.007867813110351562</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37281466134500607</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37281466134500607</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1085</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1085</min_tcp_pkts><max_tcp_pkts>1085</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1914"><ip.session_id>958</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6908819675445557</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>8.584022521972656</time_between_pkts_sum><time_between_pkts_avg>8.584022521972656</time_between_pkts_avg><time_between_pkts_max>8.584022521972656</time_between_pkts_max><time_between_pkts_min>8.584022521972656</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3716253674673458</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3716253674673458</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1915"><ip.session_id>958</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6908891201019287</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.007152557373046875</time_between_pkts_sum><time_between_pkts_avg>0.007152557373046875</time_between_pkts_avg><time_between_pkts_max>0.007152557373046875</time_between_pkts_max><time_between_pkts_min>0.007152557373046875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3716243796630761</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3716243796630761</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>3268</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>3268</min_tcp_pkts><max_tcp_pkts>3268</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1916"><ip.session_id>959</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6909520626068115</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0629425048828125</time_between_pkts_sum><time_between_pkts_avg>0.0629425048828125</time_between_pkts_avg><time_between_pkts_max>0.0629425048828125</time_between_pkts_max><time_between_pkts_min>0.0629425048828125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37161568721193344</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37161568721193344</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1917"><ip.session_id>959</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6909589767456055</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37161473238413356</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37161473238413356</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1084</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1084</min_tcp_pkts><max_tcp_pkts>1084</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1918"><ip.session_id>960</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6909520626068115</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37161568721193344</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37161568721193344</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1919"><ip.session_id>960</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.690964937210083</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37161390926065796</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37161390926065796</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>425</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>425</min_tcp_pkts><max_tcp_pkts>425</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1920"><ip.session_id>961</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6910009384155273</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.03600120544433594</time_between_pkts_sum><time_between_pkts_avg>0.03600120544433594</time_between_pkts_avg><time_between_pkts_max>0.03600120544433594</time_between_pkts_max><time_between_pkts_min>0.03600120544433594</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3716089376723905</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3716089376723905</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1921"><ip.session_id>961</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6910080909729004</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.007152557373046875</time_between_pkts_sum><time_between_pkts_avg>0.007152557373046875</time_between_pkts_avg><time_between_pkts_max>0.007152557373046875</time_between_pkts_max><time_between_pkts_min>0.007152557373046875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37160794995546165</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37160794995546165</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>9917</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>9917</min_tcp_pkts><max_tcp_pkts>9917</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1922"><ip.session_id>962</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.691014051437378</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37160712686203184</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37160712686203184</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1923"><ip.session_id>962</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6910181045532227</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0040531158447265625</time_between_pkts_sum><time_between_pkts_avg>0.0040531158447265625</time_between_pkts_avg><time_between_pkts_max>0.0040531158447265625</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37160656716058227</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37160656716058227</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>444</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>444</min_tcp_pkts><max_tcp_pkts>444</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1924"><ip.session_id>963</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6910359859466553</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.017881393432617188</time_between_pkts_sum><time_between_pkts_avg>0.017881393432617188</time_between_pkts_avg><time_between_pkts_max>0.017881393432617188</time_between_pkts_max><time_between_pkts_min>0.017881393432617188</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37160409790960824</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37160409790960824</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1925"><ip.session_id>963</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.691071033477783</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.03504753112792969</time_between_pkts_sum><time_between_pkts_avg>0.03504753112792969</time_between_pkts_avg><time_between_pkts_max>0.03504753112792969</time_between_pkts_max><time_between_pkts_min>0.03504753112792969</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3715992582728886</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3715992582728886</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>7070</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>7070</min_tcp_pkts><max_tcp_pkts>7070</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1926"><ip.session_id>964</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6910760402679443</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3715985669065049</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3715985669065049</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1927"><ip.session_id>964</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6910810470581055</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3715978755426938</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3715978755426938</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>5003</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>5003</min_tcp_pkts><max_tcp_pkts>5003</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1928"><ip.session_id>965</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6910951137542725</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.014066696166992188</time_between_pkts_sum><time_between_pkts_avg>0.014066696166992188</time_between_pkts_avg><time_between_pkts_max>0.014066696166992188</time_between_pkts_max><time_between_pkts_min>0.014066696166992188</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3715959331533725</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3715959331533725</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1929"><ip.session_id>965</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6911001205444336</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3715952417993616</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3715952417993616</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>8292</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>8292</min_tcp_pkts><max_tcp_pkts>8292</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1930"><ip.session_id>966</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.691256046295166</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.15592575073242188</time_between_pkts_sum><time_between_pkts_avg>0.15592575073242188</time_between_pkts_avg><time_between_pkts_max>0.15592575073242188</time_between_pkts_max><time_between_pkts_min>0.15592575073242188</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3715737123476672</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3715737123476672</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1931"><ip.session_id>966</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6912639141082764</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.007867813110351562</time_between_pkts_sum><time_between_pkts_avg>0.007867813110351562</time_between_pkts_avg><time_between_pkts_max>0.007867813110351562</time_between_pkts_max><time_between_pkts_min>0.007867813110351562</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3715726260653036</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3715726260653036</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>3546</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>3546</min_tcp_pkts><max_tcp_pkts>3546</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1932"><ip.session_id>967</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.691256046295166</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3715737123476672</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3715737123476672</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1933"><ip.session_id>967</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6912710666656494</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.007152557373046875</time_between_pkts_sum><time_between_pkts_avg>0.007152557373046875</time_between_pkts_avg><time_between_pkts_max>0.007152557373046875</time_between_pkts_max><time_between_pkts_min>0.007152557373046875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3715716385413938</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3715716385413938</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>49157</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>49157</min_tcp_pkts><max_tcp_pkts>49157</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1934"><ip.session_id>968</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.691275119781494</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0040531158447265625</time_between_pkts_sum><time_between_pkts_avg>0.0040531158447265625</time_between_pkts_avg><time_between_pkts_max>0.0040531158447265625</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37157107894684155</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37157107894684155</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1935"><ip.session_id>968</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6912789344787598</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.003814697265625</time_between_pkts_sum><time_between_pkts_avg>0.003814697265625</time_between_pkts_avg><time_between_pkts_max>0.003814697265625</time_between_pkts_max><time_between_pkts_min>0.003814697265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3715705522711556</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3715705522711556</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>6156</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>6156</min_tcp_pkts><max_tcp_pkts>6156</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1936"><ip.session_id>969</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.691291093826294</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.012159347534179688</time_between_pkts_sum><time_between_pkts_avg>0.012159347534179688</time_between_pkts_avg><time_between_pkts_max>0.012159347534179688</time_between_pkts_max><time_between_pkts_min>0.012159347534179688</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37156887350237106</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37156887350237106</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1937"><ip.session_id>969</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.691296100616455</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3715681822490453</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3715681822490453</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>543</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>543</min_tcp_pkts><max_tcp_pkts>543</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1938"><ip.session_id>970</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6913161277770996</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.02002716064453125</time_between_pkts_sum><time_between_pkts_avg>0.02002716064453125</time_between_pkts_avg><time_between_pkts_max>0.02002716064453125</time_between_pkts_max><time_between_pkts_min>0.02002716064453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3715654172614619</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3715654172614619</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1939"><ip.session_id>970</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.691322088241577</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3715645943564368</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3715645943564368</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>3880</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>3880</min_tcp_pkts><max_tcp_pkts>3880</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1940"><ip.session_id>971</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6913270950317383</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37156390311903253</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37156390311903253</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1941"><ip.session_id>971</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.691330909729004</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.003814697265625</time_between_pkts_sum><time_between_pkts_avg>0.003814697265625</time_between_pkts_avg><time_between_pkts_max>0.003814697265625</time_between_pkts_max><time_between_pkts_min>0.003814697265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3715633764636888</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3715633764636888</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>37</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>37</min_tcp_pkts><max_tcp_pkts>37</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1942"><ip.session_id>972</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.691352128982544</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.021219253540039062</time_between_pkts_sum><time_between_pkts_avg>0.021219253540039062</time_between_pkts_avg><time_between_pkts_max>0.021219253540039062</time_between_pkts_max><time_between_pkts_min>0.021219253540039062</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3715604469705889</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3715604469705889</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1943"><ip.session_id>972</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.691359043121338</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3715594924266356</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3715594924266356</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>9050</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>9050</min_tcp_pkts><max_tcp_pkts>9050</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1944"><ip.session_id>973</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6913630962371826</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0040531158447265625</time_between_pkts_sum><time_between_pkts_avg>0.0040531158447265625</time_between_pkts_avg><time_between_pkts_max>0.0040531158447265625</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3715589328686673</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3715589328686673</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1945"><ip.session_id>973</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6913669109344482</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.003814697265625</time_between_pkts_sum><time_between_pkts_avg>0.003814697265625</time_between_pkts_avg><time_between_pkts_max>0.003814697265625</time_between_pkts_max><time_between_pkts_min>0.003814697265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3715584062274132</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3715584062274132</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>8181</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>8181</min_tcp_pkts><max_tcp_pkts>8181</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1946"><ip.session_id>974</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.691394090652466</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.027179718017578125</time_between_pkts_sum><time_between_pkts_avg>0.027179718017578125</time_between_pkts_avg><time_between_pkts_max>0.027179718017578125</time_between_pkts_max><time_between_pkts_min>0.027179718017578125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3715546539516899</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3715546539516899</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1947"><ip.session_id>974</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.691399097442627</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3715539627512702</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3715539627512702</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>3995</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>3995</min_tcp_pkts><max_tcp_pkts>3995</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1948"><ip.session_id>975</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6914260387420654</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.026941299438476562</time_between_pkts_sum><time_between_pkts_avg>0.026941299438476562</time_between_pkts_avg><time_between_pkts_max>0.026941299438476562</time_between_pkts_max><time_between_pkts_min>0.026941299438476562</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37155024347887555</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37155024347887555</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1949"><ip.session_id>975</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6914310455322266</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3715495522948653</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3715495522948653</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>15660</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>15660</min_tcp_pkts><max_tcp_pkts>15660</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1950"><ip.session_id>976</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.691437005996704</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3715487294601108</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3715487294601108</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1951"><ip.session_id>976</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.691441059112549</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0040531158447265625</time_between_pkts_sum><time_between_pkts_avg>0.0040531158447265625</time_between_pkts_avg><time_between_pkts_max>0.0040531158447265625</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37154816993455947</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37154816993455947</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1417</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1417</min_tcp_pkts><max_tcp_pkts>1417</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1952"><ip.session_id>977</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6914680004119873</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.026941299438476562</time_between_pkts_sum><time_between_pkts_avg>0.026941299438476562</time_between_pkts_avg><time_between_pkts_max>0.026941299438476562</time_between_pkts_max><time_between_pkts_min>0.026941299438476562</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3715444507781361</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3715444507781361</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1953"><ip.session_id>977</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6914730072021484</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3715437596156776</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3715437596156776</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>81</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>81</min_tcp_pkts><max_tcp_pkts>81</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1954"><ip.session_id>978</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6914799213409424</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3715428051574624</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3715428051574624</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1955"><ip.session_id>978</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6914849281311035</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3715421140011264</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3715421140011264</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>6009</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>6009</min_tcp_pkts><max_tcp_pkts>6009</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1956"><ip.session_id>979</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.692091941833496</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.6070137023925781</time_between_pkts_sum><time_between_pkts_avg>0.6070137023925781</time_between_pkts_avg><time_between_pkts_max>0.6070137023925781</time_between_pkts_max><time_between_pkts_min>0.6070137023925781</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37145833857328536</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37145833857328536</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1957"><ip.session_id>979</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6920979022979736</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3714575161424852</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3714575161424852</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>7001</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>7001</min_tcp_pkts><max_tcp_pkts>7001</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1958"><ip.session_id>980</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.692091941833496</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37145833857328536</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37145833857328536</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1959"><ip.session_id>980</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6921041011810303</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.006198883056640625</time_between_pkts_sum><time_between_pkts_avg>0.006198883056640625</time_between_pkts_avg><time_between_pkts_max>0.006198883056640625</time_between_pkts_max><time_between_pkts_min>0.006198883056640625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37145666081831624</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37145666081831624</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>17877</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>17877</min_tcp_pkts><max_tcp_pkts>17877</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1960"><ip.session_id>981</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.692164897918701</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.06079673767089844</time_between_pkts_sum><time_between_pkts_avg>0.06079673767089844</time_between_pkts_avg><time_between_pkts_max>0.06079673767089844</time_between_pkts_max><time_between_pkts_min>0.06079673767089844</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3714482722708014</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3714482722708014</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1961"><ip.session_id>981</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6921699047088623</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37144758146612683</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37144758146612683</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1864</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1864</min_tcp_pkts><max_tcp_pkts>1864</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1962"><ip.session_id>982</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6922221183776855</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.05221366882324219</time_between_pkts_sum><time_between_pkts_avg>0.05221366882324219</time_between_pkts_avg><time_between_pkts_max>0.05221366882324219</time_between_pkts_max><time_between_pkts_min>0.05221366882324219</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37144037751335063</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37144037751335063</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1963"><ip.session_id>982</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.692228078842163</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3714395551620821</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3714395551620821</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>6510</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>6510</min_tcp_pkts><max_tcp_pkts>6510</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1964"><ip.session_id>983</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.692233085632324</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3714388643898306</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3714388643898306</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1965"><ip.session_id>983</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6922390460968018</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37143804204526204</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37143804204526204</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>3801</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>3801</min_tcp_pkts><max_tcp_pkts>3801</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1966"><ip.session_id>984</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.692233085632324</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3714388643898306</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3714388643898306</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1967"><ip.session_id>984</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6922450065612793</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37143721970433474</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37143721970433474</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>16993</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>16993</min_tcp_pkts><max_tcp_pkts>16993</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1968"><ip.session_id>985</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6922740936279297</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.029087066650390625</time_between_pkts_sum><time_between_pkts_avg>0.029087066650390625</time_between_pkts_avg><time_between_pkts_max>0.029087066650390625</time_between_pkts_max><time_between_pkts_min>0.029087066650390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3714332067328503</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3714332067328503</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1969"><ip.session_id>985</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6922800540924072</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37143238441333304</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37143238441333304</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>3324</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>3324</min_tcp_pkts><max_tcp_pkts>3324</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1970"><ip.session_id>986</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6922740936279297</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3714332067328503</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3714332067328503</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1971"><ip.session_id>986</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6922860145568848</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3714315620974568</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3714315620974568</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>3998</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>3998</min_tcp_pkts><max_tcp_pkts>3998</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1972"><ip.session_id>987</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.692331075668335</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.04506111145019531</time_between_pkts_sum><time_between_pkts_avg>0.04506111145019531</time_between_pkts_avg><time_between_pkts_max>0.04506111145019531</time_between_pkts_max><time_between_pkts_min>0.04506111145019531</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37142534550724354</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37142534550724354</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1973"><ip.session_id>987</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.692337989807129</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3714243916573183</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3714243916573183</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>9999</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>9999</min_tcp_pkts><max_tcp_pkts>9999</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1974"><ip.session_id>988</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.692331075668335</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37142534550724354</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37142534550724354</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1975"><ip.session_id>988</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6923439502716064</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.371423569376832</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.371423569376832</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>6000</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>6000</min_tcp_pkts><max_tcp_pkts>6000</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1976"><ip.session_id>989</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.692379951477051</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.03600120544433594</time_between_pkts_sum><time_between_pkts_avg>0.03600120544433594</time_between_pkts_avg><time_between_pkts_max>0.03600120544433594</time_between_pkts_max><time_between_pkts_min>0.03600120544433594</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37141860288010087</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37141860288010087</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1977"><ip.session_id>989</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.692387104034424</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.007152557373046875</time_between_pkts_sum><time_between_pkts_avg>0.007152557373046875</time_between_pkts_avg><time_between_pkts_max>0.007152557373046875</time_between_pkts_max><time_between_pkts_min>0.007152557373046875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37141761617471125</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37141761617471125</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>32782</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>32782</min_tcp_pkts><max_tcp_pkts>32782</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1978"><ip.session_id>990</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.692379951477051</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37141860288010087</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37141860288010087</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1979"><ip.session_id>990</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6923940181732178</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37141666236448456</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37141666236448456</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>6646</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>6646</min_tcp_pkts><max_tcp_pkts>6646</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1980"><ip.session_id>991</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.692397117614746</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0030994415283203125</time_between_pkts_sum><time_between_pkts_avg>0.0030994415283203125</time_between_pkts_avg><time_between_pkts_max>0.0030994415283203125</time_between_pkts_max><time_between_pkts_min>0.0030994415283203125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3714162347959732</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3714162347959732</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1981"><ip.session_id>991</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6924009323120117</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.003814697265625</time_between_pkts_sum><time_between_pkts_avg>0.003814697265625</time_between_pkts_avg><time_between_pkts_max>0.003814697265625</time_between_pkts_max><time_between_pkts_min>0.003814697265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37141570855915673</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37141570855915673</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>5100</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>5100</min_tcp_pkts><max_tcp_pkts>5100</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1982"><ip.session_id>992</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.692425012588501</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.024080276489257812</time_between_pkts_sum><time_between_pkts_avg>0.024080276489257812</time_between_pkts_avg><time_between_pkts_max>0.024080276489257812</time_between_pkts_max><time_between_pkts_min>0.024080276489257812</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3714123867236691</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3714123867236691</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1983"><ip.session_id>992</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.692430019378662</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37141169605246493</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37141169605246493</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1058</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1058</min_tcp_pkts><max_tcp_pkts>1058</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1984"><ip.session_id>993</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6924359798431396</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3714108738281902</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3714108738281902</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1985"><ip.session_id>993</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6924400329589844</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0040531158447265625</time_between_pkts_sum><time_between_pkts_avg>0.0040531158447265625</time_between_pkts_avg><time_between_pkts_max>0.0040531158447265625</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3714103147177628</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3714103147177628</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>9593</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>9593</min_tcp_pkts><max_tcp_pkts>9593</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1986"><ip.session_id>994</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6924591064453125</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.019073486328125</time_between_pkts_sum><time_between_pkts_avg>0.019073486328125</time_between_pkts_avg><time_between_pkts_max>0.019073486328125</time_between_pkts_max><time_between_pkts_min>0.019073486328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3714076836324687</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3714076836324687</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1987"><ip.session_id>994</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6924641132354736</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37140699297875596</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37140699297875596</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>32783</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>32783</min_tcp_pkts><max_tcp_pkts>32783</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1988"><ip.session_id>995</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.69252610206604</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.06198883056640625</time_between_pkts_sum><time_between_pkts_avg>0.06198883056640625</time_between_pkts_avg><time_between_pkts_max>0.06198883056640625</time_between_pkts_max><time_between_pkts_min>0.06198883056640625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3713984422407924</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3713984422407924</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1989"><ip.session_id>995</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.692531108856201</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.371397751621449</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.371397751621449</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>9666</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>9666</min_tcp_pkts><max_tcp_pkts>9666</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1990"><ip.session_id>996</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6925361156463623</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.371397061004674</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.371397061004674</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1991"><ip.session_id>996</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6925411224365234</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37139637039046747</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37139637039046747</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>2725</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>2725</min_tcp_pkts><max_tcp_pkts>2725</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1992"><ip.session_id>997</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6925649642944336</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.02384185791015625</time_between_pkts_sum><time_between_pkts_avg>0.02384185791015625</time_between_pkts_avg><time_between_pkts_max>0.02384185791015625</time_between_pkts_max><time_between_pkts_min>0.02384185791015625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37139308178662367</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37139308178662367</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1993"><ip.session_id>997</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.692573070526123</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.008106231689453125</time_between_pkts_sum><time_between_pkts_avg>0.008106231689453125</time_between_pkts_avg><time_between_pkts_max>0.008106231689453125</time_between_pkts_max><time_between_pkts_min>0.008106231689453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37139196367458366</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37139196367458366</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>3905</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>3905</min_tcp_pkts><max_tcp_pkts>3905</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1994"><ip.session_id>998</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6925649642944336</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37139308178662367</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37139308178662367</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1995"><ip.session_id>998</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6925790309906006</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0059604644775390625</time_between_pkts_sum><time_between_pkts_avg>0.0059604644775390625</time_between_pkts_avg><time_between_pkts_max>0.0059604644775390625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3713911415376728</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3713911415376728</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>6692</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>6692</min_tcp_pkts><max_tcp_pkts>6692</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1996"><ip.session_id>999</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6925649642944336</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37139308178662367</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37139308178662367</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1997"><ip.session_id>999</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6925840377807617</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37139045094548057</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37139045094548057</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>7</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>7</min_tcp_pkts><max_tcp_pkts>7</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1998"><ip.session_id>1000</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6926119327545166</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.027894973754882812</time_between_pkts_sum><time_between_pkts_avg>0.027894973754882812</time_between_pkts_avg><time_between_pkts_max>0.027894973754882812</time_between_pkts_max><time_between_pkts_min>0.027894973754882812</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37138660340742435</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37138660340742435</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="1999"><ip.session_id>1000</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6926190853118896</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.007152557373046875</time_between_pkts_sum><time_between_pkts_avg>0.007152557373046875</time_between_pkts_avg><time_between_pkts_max>0.007152557373046875</time_between_pkts_max><time_between_pkts_min>0.007152557373046875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37138561687204585</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37138561687204585</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>5959</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>5959</min_tcp_pkts><max_tcp_pkts>5959</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2000"><ip.session_id>1001</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6926119327545166</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0</time_between_pkts_sum><time_between_pkts_avg>0.0</time_between_pkts_avg><time_between_pkts_max>0.0</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37138660340742435</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37138660340742435</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2001"><ip.session_id>1001</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.692624092102051</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37138492630039943</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37138492630039943</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>7002</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>7002</min_tcp_pkts><max_tcp_pkts>7002</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2002"><ip.session_id>1002</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6926400661468506</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.015974044799804688</time_between_pkts_sum><time_between_pkts_avg>0.015974044799804688</time_between_pkts_avg><time_between_pkts_max>0.015974044799804688</time_between_pkts_max><time_between_pkts_min>0.015974044799804688</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.37138272306517117</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.37138272306517117</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2003"><ip.session_id>1002</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6926469802856445</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0069141387939453125</time_between_pkts_sum><time_between_pkts_avg>0.0069141387939453125</time_between_pkts_avg><time_between_pkts_max>0.0069141387939453125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3713817694341487</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3713817694341487</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>52869</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>52869</min_tcp_pkts><max_tcp_pkts>52869</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2004"><ip.session_id>1003</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6926519870758057</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3713810788768104</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3713810788768104</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2005"><ip.session_id>1003</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6926560401916504</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0040531158447265625</time_between_pkts_sum><time_between_pkts_avg>0.0040531158447265625</time_between_pkts_avg><time_between_pkts_max>0.0040531158447265625</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3713805198560841</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3713805198560841</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>5440</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>5440</min_tcp_pkts><max_tcp_pkts>5440</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2006"><ip.session_id>1004</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6926679611206055</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.011920928955078125</time_between_pkts_sum><time_between_pkts_avg>0.011920928955078125</time_between_pkts_avg><time_between_pkts_max>0.011920928955078125</time_between_pkts_max><time_between_pkts_min>0.011920928955078125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3713788756872313</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3713788756872313</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2007"><ip.session_id>1004</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.6926729679107666</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3713781851406544</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3713781851406544</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1031</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1031</min_tcp_pkts><max_tcp_pkts>1031</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2008"><ip.session_id>1005</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.692694902420044</duration><ip.header_len>20</ip.header_len><ip.payload_len>24</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.02193450927734375</time_between_pkts_sum><time_between_pkts_avg>0.02193450927734375</time_between_pkts_avg><time_between_pkts_max>0.02193450927734375</time_between_pkts_max><time_between_pkts_min>0.02193450927734375</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3713751599192526</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3713751599192526</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>40092</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>40092</min_tcp_pkts><max_tcp_pkts>40092</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2009"><ip.session_id>1005</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>2.692699909210205</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>42.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0050067901611328125</time_between_pkts_sum><time_between_pkts_avg>0.0050067901611328125</time_between_pkts_avg><time_between_pkts_max>0.0050067901611328125</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.3713744693864938</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.3713744693864938</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>2042</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>2042</min_tcp_pkts><max_tcp_pkts>2042</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2010"><ip.session_id>1006</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>5</ip.pkts_per_flow><duration>2.9374051094055176</duration><ip.header_len>100</ip.header_len><ip.payload_len>168</ip.payload_len><ip.avg_bytes_tot_len>59.25</ip.avg_bytes_tot_len><time_between_pkts_sum>233.0021858215332</time_between_pkts_sum><time_between_pkts_avg>46.60043716430664</time_between_pkts_avg><time_between_pkts_max>133.29219818115234</time_between_pkts_max><time_between_pkts_min>7.705926895141602</time_between_pkts_min><time_between_pkts_std>49.49724746979863</time_between_pkts_std><(-0.001, 50.0]>4</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>1</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>5</tcp_pkts_per_flow><pkts_rate>1.7021826454887312</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>1.7021826454887312</byte_rate><tcp.tcp_session_payload_up_len>5</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>5</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>5</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>1</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>4</tcp.ack><tcp.urg>0</tcp.urg><sport_g>5</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>5</dport_le><mean_tcp_pkts>37020</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>37020</min_tcp_pkts><max_tcp_pkts>37020</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2011"><ip.session_id>1006</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>3</ip.pkts_per_flow><duration>2.9077000617980957</duration><ip.header_len>60</ip.header_len><ip.payload_len>146</ip.payload_len><ip.avg_bytes_tot_len>59.25</ip.avg_bytes_tot_len><time_between_pkts_sum>11.666059494018555</time_between_pkts_sum><time_between_pkts_avg>3.888686498006185</time_between_pkts_avg><time_between_pkts_max>10.999917984008789</time_between_pkts_max><time_between_pkts_min>0.102996826171875</time_between_pkts_min><time_between_pkts_std>6.162803254069106</time_between_pkts_std><(-0.001, 50.0]>3</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>3</tcp_pkts_per_flow><pkts_rate>1.031743280338491</pkts_rate><tcp_bytes_per_flow>42</tcp_bytes_per_flow><byte_rate>1.031743280338491</byte_rate><tcp.tcp_session_payload_up_len>3</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>3</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>3</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>1</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>1</tcp.psh><tcp.ack>3</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>3</sport_le><dport_g>3</dport_g><dport_le>0</dport_le><mean_tcp_pkts>22</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>22</min_tcp_pkts><max_tcp_pkts>22</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>14</mean_tcp_len><std_tcp_len>24.24871130596428</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>42</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2012"><ip.session_id>1007</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>5</ip.pkts_per_flow><duration>8.910607099533081</duration><ip.header_len>100</ip.header_len><ip.payload_len>186</ip.payload_len><ip.avg_bytes_tot_len>75.0</ip.avg_bytes_tot_len><time_between_pkts_sum>305.47189712524414</time_between_pkts_sum><time_between_pkts_avg>61.09437942504883</time_between_pkts_avg><time_between_pkts_max>263.8828754425049</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>114.11487483116751</time_between_pkts_std><(-0.001, 50.0]>4</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>1</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>5</tcp_pkts_per_flow><pkts_rate>0.5611289942592129</pkts_rate><tcp_bytes_per_flow>18</tcp_bytes_per_flow><byte_rate>0.5611289942592129</byte_rate><tcp.tcp_session_payload_up_len>5</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>5</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>5</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>1</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>1</tcp.psh><tcp.ack>4</tcp.ack><tcp.urg>0</tcp.urg><sport_g>5</sport_g><sport_le>0</sport_le><dport_g>5</dport_g><dport_le>0</dport_le><mean_tcp_pkts>55260</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>55260</min_tcp_pkts><max_tcp_pkts>55260</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>3.6</mean_tcp_len><std_tcp_len>8.049844718999243</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>18</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2013"><ip.session_id>1007</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>5</ip.pkts_per_flow><duration>8.910628080368042</duration><ip.header_len>100</ip.header_len><ip.payload_len>364</ip.payload_len><ip.avg_bytes_tot_len>75.0</ip.avg_bytes_tot_len><time_between_pkts_sum>4.9610137939453125</time_between_pkts_sum><time_between_pkts_avg>0.9922027587890625</time_between_pkts_avg><time_between_pkts_max>4.252910614013672</time_between_pkts_max><time_between_pkts_min>0.0209808349609375</time_between_pkts_min><time_between_pkts_std>1.8400417088187582</time_between_pkts_std><(-0.001, 50.0]>5</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>5</tcp_pkts_per_flow><pkts_rate>0.5611276730330643</pkts_rate><tcp_bytes_per_flow>196</tcp_bytes_per_flow><byte_rate>0.5611276730330643</byte_rate><tcp.tcp_session_payload_up_len>5</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>5</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>4</(-0.001, 150.0]><(150.0, 300.0]>1</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>1</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>1</tcp.psh><tcp.ack>5</tcp.ack><tcp.urg>0</tcp.urg><sport_g>5</sport_g><sport_le>0</sport_le><dport_g>5</dport_g><dport_le>0</dport_le><mean_tcp_pkts>8080</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>8080</min_tcp_pkts><max_tcp_pkts>8080</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>39.2</mean_tcp_len><std_tcp_len>87.65386471799177</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>196</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2014"><ip.session_id>1008</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>5</ip.pkts_per_flow><duration>8.976907968521118</duration><ip.header_len>100</ip.header_len><ip.payload_len>190</ip.payload_len><ip.avg_bytes_tot_len>69.1</ip.avg_bytes_tot_len><time_between_pkts_sum>61.18273735046387</time_between_pkts_sum><time_between_pkts_avg>12.236547470092773</time_between_pkts_avg><time_between_pkts_max>29.82497215270996</time_between_pkts_max><time_between_pkts_min>0.00095367431640625</time_between_pkts_min><time_between_pkts_std>15.644955156578286</time_between_pkts_std><(-0.001, 50.0]>5</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>5</tcp_pkts_per_flow><pkts_rate>0.5569846563575402</pkts_rate><tcp_bytes_per_flow>22</tcp_bytes_per_flow><byte_rate>0.5569846563575402</byte_rate><tcp.tcp_session_payload_up_len>5</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>5</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>5</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>1</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>1</tcp.psh><tcp.ack>4</tcp.ack><tcp.urg>0</tcp.urg><sport_g>5</sport_g><sport_le>0</sport_le><dport_g>5</dport_g><dport_le>0</dport_le><mean_tcp_pkts>48118</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>48118</min_tcp_pkts><max_tcp_pkts>48118</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>4.4</mean_tcp_len><std_tcp_len>9.838699100999074</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>22</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2015"><ip.session_id>1008</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>5</ip.pkts_per_flow><duration>8.976918935775757</duration><ip.header_len>100</ip.header_len><ip.payload_len>301</ip.payload_len><ip.avg_bytes_tot_len>69.1</ip.avg_bytes_tot_len><time_between_pkts_sum>5.108118057250977</time_between_pkts_sum><time_between_pkts_avg>1.0216236114501953</time_between_pkts_avg><time_between_pkts_max>4.656076431274414</time_between_pkts_max><time_between_pkts_min>0.010967254638671875</time_between_pkts_min><time_between_pkts_std>2.0352342854243433</time_between_pkts_std><(-0.001, 50.0]>5</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>5</tcp_pkts_per_flow><pkts_rate>0.5569839758799064</pkts_rate><tcp_bytes_per_flow>133</tcp_bytes_per_flow><byte_rate>0.5569839758799064</byte_rate><tcp.tcp_session_payload_up_len>5</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>5</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>5</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>1</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>1</tcp.psh><tcp.ack>5</tcp.ack><tcp.urg>0</tcp.urg><sport_g>5</sport_g><sport_le>0</sport_le><dport_g>5</dport_g><dport_le>0</dport_le><mean_tcp_pkts>8080</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>8080</min_tcp_pkts><max_tcp_pkts>8080</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>26.6</mean_tcp_len><std_tcp_len>59.47940820149441</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>133</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2016"><ip.session_id>1009</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>2</ip.pkts_per_flow><duration>9.119883060455322</duration><ip.header_len>40</ip.header_len><ip.payload_len>60</ip.payload_len><ip.avg_bytes_tot_len>53.333333333333336</ip.avg_bytes_tot_len><time_between_pkts_sum>142.8971290588379</time_between_pkts_sum><time_between_pkts_avg>71.44856452941895</time_between_pkts_avg><time_between_pkts_max>113.91997337341309</time_between_pkts_max><time_between_pkts_min>28.977155685424805</time_between_pkts_min><time_between_pkts_std>60.06364240026913</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>1</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>2</tcp_pkts_per_flow><pkts_rate>0.21930105756204152</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.21930105756204152</byte_rate><tcp.tcp_session_payload_up_len>2</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>2</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>2</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>2</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>2</dport_le><mean_tcp_pkts>46326</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>46326</min_tcp_pkts><max_tcp_pkts>46326</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2017"><ip.session_id>1009</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>9.090905904769897</duration><ip.header_len>20</ip.header_len><ip.payload_len>40</ip.payload_len><ip.avg_bytes_tot_len>53.333333333333336</ip.avg_bytes_tot_len><time_between_pkts_sum>0.06699562072753906</time_between_pkts_sum><time_between_pkts_avg>0.06699562072753906</time_between_pkts_avg><time_between_pkts_max>0.06699562072753906</time_between_pkts_max><time_between_pkts_min>0.06699562072753906</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.11000003855229776</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.11000003855229776</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>22</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>22</min_tcp_pkts><max_tcp_pkts>22</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2018"><ip.session_id>1010</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>2</ip.pkts_per_flow><duration>9.208945035934448</duration><ip.header_len>40</ip.header_len><ip.payload_len>60</ip.payload_len><ip.avg_bytes_tot_len>53.333333333333336</ip.avg_bytes_tot_len><time_between_pkts_sum>88.99688720703125</time_between_pkts_sum><time_between_pkts_avg>44.498443603515625</time_between_pkts_avg><time_between_pkts_max>58.203935623168945</time_between_pkts_max><time_between_pkts_min>30.792951583862305</time_between_pkts_min><time_between_pkts_std>19.38249269318995</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>1</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>2</tcp_pkts_per_flow><pkts_rate>0.2171801430235224</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.2171801430235224</byte_rate><tcp.tcp_session_payload_up_len>2</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>2</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>2</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>2</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>2</dport_le><mean_tcp_pkts>46327</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>46327</min_tcp_pkts><max_tcp_pkts>46327</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2019"><ip.session_id>1010</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>9.178152084350586</duration><ip.header_len>20</ip.header_len><ip.payload_len>40</ip.payload_len><ip.avg_bytes_tot_len>53.333333333333336</ip.avg_bytes_tot_len><time_between_pkts_sum>0.06508827209472656</time_between_pkts_sum><time_between_pkts_avg>0.06508827209472656</time_between_pkts_avg><time_between_pkts_max>0.06508827209472656</time_between_pkts_max><time_between_pkts_min>0.06508827209472656</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.1089543941753888</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.1089543941753888</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>22</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>22</min_tcp_pkts><max_tcp_pkts>22</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2020"><ip.session_id>1011</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>2</ip.pkts_per_flow><duration>9.310529947280884</duration><ip.header_len>40</ip.header_len><ip.payload_len>60</ip.payload_len><ip.avg_bytes_tot_len>53.333333333333336</ip.avg_bytes_tot_len><time_between_pkts_sum>101.49693489074707</time_between_pkts_sum><time_between_pkts_avg>50.748467445373535</time_between_pkts_avg><time_between_pkts_max>69.15497779846191</time_between_pkts_max><time_between_pkts_min>32.341957092285156</time_between_pkts_min><time_between_pkts_std>26.030736577298374</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>1</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>2</tcp_pkts_per_flow><pkts_rate>0.21481054368812752</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.21481054368812752</byte_rate><tcp.tcp_session_payload_up_len>2</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>2</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>2</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>2</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>2</dport_le><mean_tcp_pkts>46328</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>46328</min_tcp_pkts><max_tcp_pkts>46328</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2021"><ip.session_id>1011</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>9.278187990188599</duration><ip.header_len>20</ip.header_len><ip.payload_len>40</ip.payload_len><ip.avg_bytes_tot_len>53.333333333333336</ip.avg_bytes_tot_len><time_between_pkts_sum>0.08797645568847656</time_between_pkts_sum><time_between_pkts_avg>0.08797645568847656</time_between_pkts_avg><time_between_pkts_max>0.08797645568847656</time_between_pkts_max><time_between_pkts_min>0.08797645568847656</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.10777966571247204</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.10777966571247204</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>22</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>22</min_tcp_pkts><max_tcp_pkts>22</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2022"><ip.session_id>1012</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>2</ip.pkts_per_flow><duration>9.413065910339355</duration><ip.header_len>40</ip.header_len><ip.payload_len>56</ip.payload_len><ip.avg_bytes_tot_len>52.0</ip.avg_bytes_tot_len><time_between_pkts_sum>102.44011878967285</time_between_pkts_sum><time_between_pkts_avg>51.220059394836426</time_between_pkts_avg><time_between_pkts_max>67.88110733032227</time_between_pkts_max><time_between_pkts_min>34.559011459350586</time_between_pkts_min><time_between_pkts_std>23.56227995371233</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>1</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>2</tcp_pkts_per_flow><pkts_rate>0.21247062530425828</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.21247062530425828</byte_rate><tcp.tcp_session_payload_up_len>2</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>2</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>2</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>2</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>2</dport_le><mean_tcp_pkts>46329</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>46329</min_tcp_pkts><max_tcp_pkts>46329</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2023"><ip.session_id>1012</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>9.378506898880005</duration><ip.header_len>20</ip.header_len><ip.payload_len>40</ip.payload_len><ip.avg_bytes_tot_len>52.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.09584426879882812</time_between_pkts_sum><time_between_pkts_avg>0.09584426879882812</time_between_pkts_avg><time_between_pkts_max>0.09584426879882812</time_between_pkts_max><time_between_pkts_min>0.09584426879882812</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.10662678087056922</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.10662678087056922</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>22</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>22</min_tcp_pkts><max_tcp_pkts>22</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2024"><ip.session_id>1013</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>2</ip.pkts_per_flow><duration>18.53156304359436</duration><ip.header_len>40</ip.header_len><ip.payload_len>64</ip.payload_len><ip.avg_bytes_tot_len>52.0</ip.avg_bytes_tot_len><time_between_pkts_sum>76.30133628845215</time_between_pkts_sum><time_between_pkts_avg>38.150668144226074</time_between_pkts_avg><time_between_pkts_max>51.28312110900879</time_between_pkts_max><time_between_pkts_min>25.01821517944336</time_between_pkts_min><time_between_pkts_std>18.572093090022477</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>1</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>2</tcp_pkts_per_flow><pkts_rate>0.10792397788006998</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.10792397788006998</byte_rate><tcp.tcp_session_payload_up_len>2</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>2</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>2</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>1</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>2</tcp.ack><tcp.urg>0</tcp.urg><sport_g>2</sport_g><sport_le>0</sport_le><dport_g>2</dport_g><dport_le>0</dport_le><mean_tcp_pkts>38658</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>38658</min_tcp_pkts><max_tcp_pkts>38658</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2025"><ip.session_id>1013</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>3</ip.pkts_per_flow><duration>18.53158712387085</duration><ip.header_len>60</ip.header_len><ip.payload_len>96</ip.payload_len><ip.avg_bytes_tot_len>52.0</ip.avg_bytes_tot_len><time_between_pkts_sum>878.4167766571045</time_between_pkts_sum><time_between_pkts_avg>292.80559221903485</time_between_pkts_avg><time_between_pkts_max>878.3628940582275</time_between_pkts_max><time_between_pkts_min>0.024080276489257812</time_between_pkts_min><time_between_pkts_std>507.107498772284</time_between_pkts_std><(-0.001, 50.0]>2</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>3</tcp_pkts_per_flow><pkts_rate>0.16188575646257786</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.16188575646257786</byte_rate><tcp.tcp_session_payload_up_len>3</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>3</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>3</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>1</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>3</tcp.ack><tcp.urg>0</tcp.urg><sport_g>3</sport_g><sport_le>0</sport_le><dport_g>3</dport_g><dport_le>0</dport_le><mean_tcp_pkts>8080</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>8080</min_tcp_pkts><max_tcp_pkts>8080</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2026"><ip.session_id>1014</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>2</ip.pkts_per_flow><duration>9.507939100265503</duration><ip.header_len>40</ip.header_len><ip.payload_len>60</ip.payload_len><ip.avg_bytes_tot_len>53.333333333333336</ip.avg_bytes_tot_len><time_between_pkts_sum>69.7472095489502</time_between_pkts_sum><time_between_pkts_avg>34.8736047744751</time_between_pkts_avg><time_between_pkts_max>40.46511650085449</time_between_pkts_max><time_between_pkts_min>29.282093048095703</time_between_pkts_min><time_between_pkts_std>7.907591717613938</time_between_pkts_std><(-0.001, 50.0]>2</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>2</tcp_pkts_per_flow><pkts_rate>0.21035052695532636</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.21035052695532636</byte_rate><tcp.tcp_session_payload_up_len>2</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>2</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>2</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>2</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>2</dport_le><mean_tcp_pkts>46330</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>46330</min_tcp_pkts><max_tcp_pkts>46330</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2027"><ip.session_id>1014</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>9.478657007217407</duration><ip.header_len>20</ip.header_len><ip.payload_len>40</ip.payload_len><ip.avg_bytes_tot_len>53.333333333333336</ip.avg_bytes_tot_len><time_between_pkts_sum>0.07796287536621094</time_between_pkts_sum><time_between_pkts_avg>0.07796287536621094</time_between_pkts_avg><time_between_pkts_max>0.07796287536621094</time_between_pkts_max><time_between_pkts_min>0.07796287536621094</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.10550017784571826</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.10550017784571826</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>22</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>22</min_tcp_pkts><max_tcp_pkts>22</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2028"><ip.session_id>1015</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>2</ip.pkts_per_flow><duration>9.609008073806763</duration><ip.header_len>40</ip.header_len><ip.payload_len>56</ip.payload_len><ip.avg_bytes_tot_len>50.666666666666664</ip.avg_bytes_tot_len><time_between_pkts_sum>79.50878143310547</time_between_pkts_sum><time_between_pkts_avg>39.754390716552734</time_between_pkts_avg><time_between_pkts_max>70.99080085754395</time_between_pkts_max><time_between_pkts_min>8.517980575561523</time_between_pkts_min><time_between_pkts_std>44.174954861238255</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>1</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>2</tcp_pkts_per_flow><pkts_rate>0.2081380288826907</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.2081380288826907</byte_rate><tcp.tcp_session_payload_up_len>2</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>2</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>2</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>2</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>2</dport_le><mean_tcp_pkts>46331</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>46331</min_tcp_pkts><max_tcp_pkts>46331</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2029"><ip.session_id>1015</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>9.579004049301147</duration><ip.header_len>20</ip.header_len><ip.payload_len>36</ip.payload_len><ip.avg_bytes_tot_len>50.666666666666664</ip.avg_bytes_tot_len><time_between_pkts_sum>0.07414817810058594</time_between_pkts_sum><time_between_pkts_avg>0.07414817810058594</time_between_pkts_avg><time_between_pkts_max>0.07414817810058594</time_between_pkts_max><time_between_pkts_min>0.07414817810058594</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.10439498666596311</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.10439498666596311</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>22</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>22</min_tcp_pkts><max_tcp_pkts>22</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2030"><ip.session_id>1016</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>9.65999698638916</duration><ip.header_len>20</ip.header_len><ip.payload_len>308</ip.payload_len><ip.avg_bytes_tot_len>328.0</ip.avg_bytes_tot_len><time_between_pkts_sum>25.44999122619629</time_between_pkts_sum><time_between_pkts_avg>25.44999122619629</time_between_pkts_avg><time_between_pkts_max>25.44999122619629</time_between_pkts_max><time_between_pkts_min>25.44999122619629</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>0</tcp_pkts_per_flow><pkts_rate>0.0</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.0</byte_rate><tcp.tcp_session_payload_up_len>0</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>0</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>0</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>0</dport_le><mean_tcp_pkts>0</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>0</min_tcp_pkts><max_tcp_pkts>0</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2031"><ip.session_id>1017</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>2</ip.pkts_per_flow><duration>9.719911098480225</duration><ip.header_len>40</ip.header_len><ip.payload_len>52</ip.payload_len><ip.avg_bytes_tot_len>48.0</ip.avg_bytes_tot_len><time_between_pkts_sum>59.780120849609375</time_between_pkts_sum><time_between_pkts_avg>29.890060424804688</time_between_pkts_avg><time_between_pkts_max>34.92307662963867</time_between_pkts_max><time_between_pkts_min>24.857044219970703</time_between_pkts_min><time_between_pkts_std>7.117759776519784</time_between_pkts_std><(-0.001, 50.0]>2</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>2</tcp_pkts_per_flow><pkts_rate>0.2057631988334455</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.2057631988334455</byte_rate><tcp.tcp_session_payload_up_len>2</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>2</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>2</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>2</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>2</dport_le><mean_tcp_pkts>46338</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>46338</min_tcp_pkts><max_tcp_pkts>46338</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2032"><ip.session_id>1017</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>9.684988021850586</duration><ip.header_len>20</ip.header_len><ip.payload_len>32</ip.payload_len><ip.avg_bytes_tot_len>48.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.06604194641113281</time_between_pkts_sum><time_between_pkts_avg>0.06604194641113281</time_between_pkts_avg><time_between_pkts_max>0.06604194641113281</time_between_pkts_max><time_between_pkts_min>0.06604194641113281</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.10325257994577491</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.10325257994577491</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>22</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>22</min_tcp_pkts><max_tcp_pkts>22</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2033"><ip.session_id>1018</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>9.76059103012085</duration><ip.header_len>20</ip.header_len><ip.payload_len>40</ip.payload_len><ip.avg_bytes_tot_len>50.0</ip.avg_bytes_tot_len><time_between_pkts_sum>40.679931640625</time_between_pkts_sum><time_between_pkts_avg>40.679931640625</time_between_pkts_avg><time_between_pkts_max>40.679931640625</time_between_pkts_max><time_between_pkts_min>40.679931640625</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.10245281222356661</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.10245281222356661</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>46342</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>46342</min_tcp_pkts><max_tcp_pkts>46342</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2034"><ip.session_id>1018</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>9.76065707206726</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>50.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.06604194641113281</time_between_pkts_sum><time_between_pkts_avg>0.06604194641113281</time_between_pkts_avg><time_between_pkts_max>0.06604194641113281</time_between_pkts_max><time_between_pkts_min>0.06604194641113281</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.10245211901376684</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.10245211901376684</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>22</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>22</min_tcp_pkts><max_tcp_pkts>22</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2035"><ip.session_id>1019</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>9.786026954650879</duration><ip.header_len>20</ip.header_len><ip.payload_len>40</ip.payload_len><ip.avg_bytes_tot_len>50.0</ip.avg_bytes_tot_len><time_between_pkts_sum>25.369882583618164</time_between_pkts_sum><time_between_pkts_avg>25.369882583618164</time_between_pkts_avg><time_between_pkts_max>25.369882583618164</time_between_pkts_max><time_between_pkts_min>25.369882583618164</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.10218651600226207</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.10218651600226207</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>46343</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>46343</min_tcp_pkts><max_tcp_pkts>46343</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2036"><ip.session_id>1019</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>9.786089897155762</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>50.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0629425048828125</time_between_pkts_sum><time_between_pkts_avg>0.0629425048828125</time_between_pkts_avg><time_between_pkts_max>0.0629425048828125</time_between_pkts_max><time_between_pkts_min>0.0629425048828125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.10218585875556292</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.10218585875556292</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1</min_tcp_pkts><max_tcp_pkts>1</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2037"><ip.session_id>1020</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>9.810940027236938</duration><ip.header_len>20</ip.header_len><ip.payload_len>40</ip.payload_len><ip.avg_bytes_tot_len>50.0</ip.avg_bytes_tot_len><time_between_pkts_sum>24.850130081176758</time_between_pkts_sum><time_between_pkts_avg>24.850130081176758</time_between_pkts_avg><time_between_pkts_max>24.850130081176758</time_between_pkts_max><time_between_pkts_min>24.850130081176758</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.10192703219302326</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.10192703219302326</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>1</tcp.ack><tcp.urg>0</tcp.urg><sport_g>1</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>1</dport_le><mean_tcp_pkts>46344</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>46344</min_tcp_pkts><max_tcp_pkts>46344</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2038"><ip.session_id>1020</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>9.810983896255493</duration><ip.header_len>20</ip.header_len><ip.payload_len>20</ip.payload_len><ip.avg_bytes_tot_len>50.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0438690185546875</time_between_pkts_sum><time_between_pkts_avg>0.0438690185546875</time_between_pkts_avg><time_between_pkts_max>0.0438690185546875</time_between_pkts_max><time_between_pkts_min>0.0438690185546875</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>1</tcp_pkts_per_flow><pkts_rate>0.10192657643456787</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.10192657643456787</byte_rate><tcp.tcp_session_payload_up_len>1</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>1</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>1</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>1</sport_le><dport_g>1</dport_g><dport_le>0</dport_le><mean_tcp_pkts>1</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>1</min_tcp_pkts><max_tcp_pkts>1</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2039"><ip.session_id>1021</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>6</ip.pkts_per_flow><duration>10.387785911560059</duration><ip.header_len>120</ip.header_len><ip.payload_len>370</ip.payload_len><ip.avg_bytes_tot_len>88.66666666666667</ip.avg_bytes_tot_len><time_between_pkts_sum>535.0379943847656</time_between_pkts_sum><time_between_pkts_avg>89.17299906412761</time_between_pkts_avg><time_between_pkts_max>490.1010990142822</time_between_pkts_max><time_between_pkts_min>0.012874603271484375</time_between_pkts_min><time_between_pkts_std>196.65975717658216</time_between_pkts_std><(-0.001, 50.0]>5</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>1</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>6</tcp_pkts_per_flow><pkts_rate>0.5776014302838965</pkts_rate><tcp_bytes_per_flow>170</tcp_bytes_per_flow><byte_rate>0.5776014302838965</byte_rate><tcp.tcp_session_payload_up_len>6</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>6</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>5</(-0.001, 150.0]><(150.0, 300.0]>1</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>1</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>1</tcp.psh><tcp.ack>5</tcp.ack><tcp.urg>0</tcp.urg><sport_g>6</sport_g><sport_le>0</sport_le><dport_g>6</dport_g><dport_le>0</dport_le><mean_tcp_pkts>48126</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>48126</min_tcp_pkts><max_tcp_pkts>48126</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>28.333333333333332</mean_tcp_len><std_tcp_len>69.40220937885671</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>170</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2040"><ip.session_id>1021</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>6</ip.pkts_per_flow><duration>10.38779592514038</duration><ip.header_len>120</ip.header_len><ip.payload_len>454</ip.payload_len><ip.avg_bytes_tot_len>88.66666666666667</ip.avg_bytes_tot_len><time_between_pkts_sum>4.422903060913086</time_between_pkts_sum><time_between_pkts_avg>0.737150510152181</time_between_pkts_avg><time_between_pkts_max>3.4589767456054688</time_between_pkts_max><time_between_pkts_min>0.010013580322265625</time_between_pkts_min><time_between_pkts_std>1.3612213856632873</time_between_pkts_std><(-0.001, 50.0]>6</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>6</tcp_pkts_per_flow><pkts_rate>0.577600873490294</pkts_rate><tcp_bytes_per_flow>254</tcp_bytes_per_flow><byte_rate>0.577600873490294</byte_rate><tcp.tcp_session_payload_up_len>6</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>6</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>5</(-0.001, 150.0]><(150.0, 300.0]>1</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>1</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>2</tcp.psh><tcp.ack>6</tcp.ack><tcp.urg>0</tcp.urg><sport_g>6</sport_g><sport_le>0</sport_le><dport_g>6</dport_g><dport_le>0</dport_le><mean_tcp_pkts>8080</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>8080</min_tcp_pkts><max_tcp_pkts>8080</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>42.333333333333336</mean_tcp_len><std_tcp_len>101.26532805786326</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>249</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2041"><ip.session_id>1022</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>6</ip.pkts_per_flow><duration>10.388286113739014</duration><ip.header_len>120</ip.header_len><ip.payload_len>355</ip.payload_len><ip.avg_bytes_tot_len>85.83333333333333</ip.avg_bytes_tot_len><time_between_pkts_sum>4.627227783203125</time_between_pkts_sum><time_between_pkts_avg>0.7712046305338541</time_between_pkts_avg><time_between_pkts_max>1.6179084777832031</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.7311351729636848</time_between_pkts_std><(-0.001, 50.0]>6</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>6</tcp_pkts_per_flow><pkts_rate>0.5775736184301574</pkts_rate><tcp_bytes_per_flow>155</tcp_bytes_per_flow><byte_rate>0.5775736184301574</byte_rate><tcp.tcp_session_payload_up_len>6</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>6</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>5</(-0.001, 150.0]><(150.0, 300.0]>1</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>1</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>1</tcp.psh><tcp.ack>5</tcp.ack><tcp.urg>0</tcp.urg><sport_g>6</sport_g><sport_le>0</sport_le><dport_g>6</dport_g><dport_le>0</dport_le><mean_tcp_pkts>48134</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>48134</min_tcp_pkts><max_tcp_pkts>48134</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>25.833333333333332</mean_tcp_len><std_tcp_len>63.27848502189877</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>155</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2042"><ip.session_id>1022</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>6</ip.pkts_per_flow><duration>10.388293027877808</duration><ip.header_len>120</ip.header_len><ip.payload_len>435</ip.payload_len><ip.avg_bytes_tot_len>85.83333333333333</ip.avg_bytes_tot_len><time_between_pkts_sum>0.2999305725097656</time_between_pkts_sum><time_between_pkts_avg>0.0499884287516276</time_between_pkts_avg><time_between_pkts_max>0.11801719665527344</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.04925237750044397</time_between_pkts_std><(-0.001, 50.0]>6</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>6</tcp_pkts_per_flow><pkts_rate>0.5775732340143395</pkts_rate><tcp_bytes_per_flow>235</tcp_bytes_per_flow><byte_rate>0.5775732340143395</byte_rate><tcp.tcp_session_payload_up_len>6</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>6</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>5</(-0.001, 150.0]><(150.0, 300.0]>1</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>1</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>2</tcp.psh><tcp.ack>6</tcp.ack><tcp.urg>0</tcp.urg><sport_g>6</sport_g><sport_le>0</sport_le><dport_g>6</dport_g><dport_le>0</dport_le><mean_tcp_pkts>8080</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>8080</min_tcp_pkts><max_tcp_pkts>8080</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>39.166666666666664</mean_tcp_len><std_tcp_len>93.51024899264608</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>230</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2043"><ip.session_id>1023</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>5</ip.pkts_per_flow><duration>10.389334917068481</duration><ip.header_len>100</ip.header_len><ip.payload_len>327</ip.payload_len><ip.avg_bytes_tot_len>82.8</ip.avg_bytes_tot_len><time_between_pkts_sum>1.154184341430664</time_between_pkts_sum><time_between_pkts_avg>0.2308368682861328</time_between_pkts_avg><time_between_pkts_max>1.0418891906738281</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.4538406590456143</time_between_pkts_std><(-0.001, 50.0]>5</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>5</tcp_pkts_per_flow><pkts_rate>0.48126276031255627</pkts_rate><tcp_bytes_per_flow>159</tcp_bytes_per_flow><byte_rate>0.48126276031255627</byte_rate><tcp.tcp_session_payload_up_len>5</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>5</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>4</(-0.001, 150.0]><(150.0, 300.0]>1</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>1</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>1</tcp.psh><tcp.ack>4</tcp.ack><tcp.urg>0</tcp.urg><sport_g>5</sport_g><sport_le>0</sport_le><dport_g>5</dport_g><dport_le>0</dport_le><mean_tcp_pkts>48150</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>48150</min_tcp_pkts><max_tcp_pkts>48150</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>31.8</mean_tcp_len><std_tcp_len>71.10696168449331</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>159</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2044"><ip.session_id>1023</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>5</ip.pkts_per_flow><duration>10.389342069625854</duration><ip.header_len>100</ip.header_len><ip.payload_len>301</ip.payload_len><ip.avg_bytes_tot_len>82.8</ip.avg_bytes_tot_len><time_between_pkts_sum>0.4100799560546875</time_between_pkts_sum><time_between_pkts_avg>0.0820159912109375</time_between_pkts_avg><time_between_pkts_max>0.2760887145996094</time_between_pkts_max><time_between_pkts_min>0.007152557373046875</time_between_pkts_min><time_between_pkts_std>0.11284933401620048</time_between_pkts_std><(-0.001, 50.0]>5</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>5</tcp_pkts_per_flow><pkts_rate>0.48126242898652216</pkts_rate><tcp_bytes_per_flow>133</tcp_bytes_per_flow><byte_rate>0.48126242898652216</byte_rate><tcp.tcp_session_payload_up_len>5</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>5</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>5</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>1</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>1</tcp.psh><tcp.ack>5</tcp.ack><tcp.urg>0</tcp.urg><sport_g>5</sport_g><sport_le>0</sport_le><dport_g>5</dport_g><dport_le>0</dport_le><mean_tcp_pkts>8080</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>8080</min_tcp_pkts><max_tcp_pkts>8080</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>26.6</mean_tcp_len><std_tcp_len>59.47940820149441</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>133</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2045"><ip.session_id>1024</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>5</ip.pkts_per_flow><duration>10.389396905899048</duration><ip.header_len>100</ip.header_len><ip.payload_len>186</ip.payload_len><ip.avg_bytes_tot_len>75.0</ip.avg_bytes_tot_len><time_between_pkts_sum>9.198665618896484</time_between_pkts_sum><time_between_pkts_avg>1.8397331237792969</time_between_pkts_avg><time_between_pkts_max>6.817817687988281</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>2.8724837508481804</time_between_pkts_std><(-0.001, 50.0]>5</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>5</tcp_pkts_per_flow><pkts_rate>0.48125988883541687</pkts_rate><tcp_bytes_per_flow>18</tcp_bytes_per_flow><byte_rate>0.48125988883541687</byte_rate><tcp.tcp_session_payload_up_len>5</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>5</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>5</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>1</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>1</tcp.psh><tcp.ack>4</tcp.ack><tcp.urg>0</tcp.urg><sport_g>5</sport_g><sport_le>0</sport_le><dport_g>5</dport_g><dport_le>0</dport_le><mean_tcp_pkts>48162</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>48162</min_tcp_pkts><max_tcp_pkts>48162</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>3.6</mean_tcp_len><std_tcp_len>8.049844718999243</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>18</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2046"><ip.session_id>1024</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>5</ip.pkts_per_flow><duration>10.38941502571106</duration><ip.header_len>100</ip.header_len><ip.payload_len>364</ip.payload_len><ip.avg_bytes_tot_len>75.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.11944770812988281</time_between_pkts_sum><time_between_pkts_avg>0.023889541625976562</time_between_pkts_avg><time_between_pkts_max>0.050067901611328125</time_between_pkts_max><time_between_pkts_min>0.008106231689453125</time_between_pkts_min><time_between_pkts_std>0.01734599621566974</time_between_pkts_std><(-0.001, 50.0]>5</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>5</tcp_pkts_per_flow><pkts_rate>0.4812590494870327</pkts_rate><tcp_bytes_per_flow>196</tcp_bytes_per_flow><byte_rate>0.4812590494870327</byte_rate><tcp.tcp_session_payload_up_len>5</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>5</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>4</(-0.001, 150.0]><(150.0, 300.0]>1</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>1</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>1</tcp.psh><tcp.ack>5</tcp.ack><tcp.urg>0</tcp.urg><sport_g>5</sport_g><sport_le>0</sport_le><dport_g>5</dport_g><dport_le>0</dport_le><mean_tcp_pkts>8080</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>8080</min_tcp_pkts><max_tcp_pkts>8080</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>39.2</mean_tcp_len><std_tcp_len>87.65386471799177</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>196</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2047"><ip.session_id>1025</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>6</ip.pkts_per_flow><duration>10.389843940734863</duration><ip.header_len>120</ip.header_len><ip.payload_len>370</ip.payload_len><ip.avg_bytes_tot_len>88.66666666666667</ip.avg_bytes_tot_len><time_between_pkts_sum>0.4932880401611328</time_between_pkts_sum><time_between_pkts_avg>0.0822146733601888</time_between_pkts_avg><time_between_pkts_max>0.3750324249267578</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.1461499602058994</time_between_pkts_std><(-0.001, 50.0]>6</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>6</tcp_pkts_per_flow><pkts_rate>0.5774870184985306</pkts_rate><tcp_bytes_per_flow>170</tcp_bytes_per_flow><byte_rate>0.5774870184985306</byte_rate><tcp.tcp_session_payload_up_len>6</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>6</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>5</(-0.001, 150.0]><(150.0, 300.0]>1</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>1</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>1</tcp.psh><tcp.ack>5</tcp.ack><tcp.urg>0</tcp.urg><sport_g>6</sport_g><sport_le>0</sport_le><dport_g>6</dport_g><dport_le>0</dport_le><mean_tcp_pkts>48178</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>48178</min_tcp_pkts><max_tcp_pkts>48178</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>28.333333333333332</mean_tcp_len><std_tcp_len>69.40220937885671</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>170</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2048"><ip.session_id>1025</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>6</ip.pkts_per_flow><duration>10.389851093292236</duration><ip.header_len>120</ip.header_len><ip.payload_len>454</ip.payload_len><ip.avg_bytes_tot_len>88.66666666666667</ip.avg_bytes_tot_len><time_between_pkts_sum>0.25081634521484375</time_between_pkts_sum><time_between_pkts_avg>0.04180272420247396</time_between_pkts_avg><time_between_pkts_max>0.10609626770019531</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.04318093310382783</time_between_pkts_std><(-0.001, 50.0]>6</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>6</tcp_pkts_per_flow><pkts_rate>0.5774866209462467</pkts_rate><tcp_bytes_per_flow>254</tcp_bytes_per_flow><byte_rate>0.5774866209462467</byte_rate><tcp.tcp_session_payload_up_len>6</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>6</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>5</(-0.001, 150.0]><(150.0, 300.0]>1</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>1</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>2</tcp.psh><tcp.ack>6</tcp.ack><tcp.urg>0</tcp.urg><sport_g>6</sport_g><sport_le>0</sport_le><dport_g>6</dport_g><dport_le>0</dport_le><mean_tcp_pkts>8080</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>8080</min_tcp_pkts><max_tcp_pkts>8080</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>42.333333333333336</mean_tcp_len><std_tcp_len>101.26532805786326</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>249</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2049"><ip.session_id>1026</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>5</ip.pkts_per_flow><duration>10.425985097885132</duration><ip.header_len>100</ip.header_len><ip.payload_len>188</ip.payload_len><ip.avg_bytes_tot_len>63.1</ip.avg_bytes_tot_len><time_between_pkts_sum>2.3331642150878906</time_between_pkts_sum><time_between_pkts_avg>0.4666328430175781</time_between_pkts_avg><time_between_pkts_max>1.9731521606445312</time_between_pkts_max><time_between_pkts_min>0.008106231689453125</time_between_pkts_min><time_between_pkts_std>0.852500601475102</time_between_pkts_std><(-0.001, 50.0]>5</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>5</tcp_pkts_per_flow><pkts_rate>0.47957099046825125</pkts_rate><tcp_bytes_per_flow>20</tcp_bytes_per_flow><byte_rate>0.47957099046825125</byte_rate><tcp.tcp_session_payload_up_len>5</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>5</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>5</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>1</tcp.rst><tcp.psh>1</tcp.psh><tcp.ack>4</tcp.ack><tcp.urg>0</tcp.urg><sport_g>5</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>5</dport_le><mean_tcp_pkts>44946</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>44946</min_tcp_pkts><max_tcp_pkts>44946</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>4</mean_tcp_len><std_tcp_len>8.94427190999916</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>20</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2050"><ip.session_id>1026</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>5</ip.pkts_per_flow><duration>10.386570930480957</duration><ip.header_len>100</ip.header_len><ip.payload_len>243</ip.payload_len><ip.avg_bytes_tot_len>63.1</ip.avg_bytes_tot_len><time_between_pkts_sum>1.3146400451660156</time_between_pkts_sum><time_between_pkts_avg>0.2629280090332031</time_between_pkts_avg><time_between_pkts_max>0.8649826049804688</time_between_pkts_max><time_between_pkts_min>0.007867813110351562</time_between_pkts_min><time_between_pkts_std>0.3479994774058014</time_between_pkts_std><(-0.001, 50.0]>5</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>5</tcp_pkts_per_flow><pkts_rate>0.48139082989620247</pkts_rate><tcp_bytes_per_flow>75</tcp_bytes_per_flow><byte_rate>0.48139082989620247</byte_rate><tcp.tcp_session_payload_up_len>5</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>5</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>5</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>1</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>3</tcp.psh><tcp.ack>5</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>5</sport_le><dport_g>5</dport_g><dport_le>0</dport_le><mean_tcp_pkts>22</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>22</min_tcp_pkts><max_tcp_pkts>22</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>15</mean_tcp_len><std_tcp_len>20.024984394500787</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>42</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2051"><ip.session_id>1027</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>5</ip.pkts_per_flow><duration>10.390290975570679</duration><ip.header_len>100</ip.header_len><ip.payload_len>228</ip.payload_len><ip.avg_bytes_tot_len>79.2</ip.avg_bytes_tot_len><time_between_pkts_sum>0.5331039428710938</time_between_pkts_sum><time_between_pkts_avg>0.10662078857421875</time_between_pkts_avg><time_between_pkts_max>0.4398822784423828</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.18682004293081816</time_between_pkts_std><(-0.001, 50.0]>5</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>5</tcp_pkts_per_flow><pkts_rate>0.48121847711058724</pkts_rate><tcp_bytes_per_flow>60</tcp_bytes_per_flow><byte_rate>0.48121847711058724</byte_rate><tcp.tcp_session_payload_up_len>5</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>5</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>5</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>1</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>1</tcp.psh><tcp.ack>4</tcp.ack><tcp.urg>0</tcp.urg><sport_g>5</sport_g><sport_le>0</sport_le><dport_g>5</dport_g><dport_le>0</dport_le><mean_tcp_pkts>48188</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>48188</min_tcp_pkts><max_tcp_pkts>48188</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>12</mean_tcp_len><std_tcp_len>26.832815729997478</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>60</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2052"><ip.session_id>1027</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>5</ip.pkts_per_flow><duration>10.39029598236084</duration><ip.header_len>100</ip.header_len><ip.payload_len>364</ip.payload_len><ip.avg_bytes_tot_len>79.2</ip.avg_bytes_tot_len><time_between_pkts_sum>1.2052059173583984</time_between_pkts_sum><time_between_pkts_avg>0.2410411834716797</time_between_pkts_avg><time_between_pkts_max>0.7770061492919922</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.3381061693160914</time_between_pkts_std><(-0.001, 50.0]>5</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>5</tcp_pkts_per_flow><pkts_rate>0.4812182452249951</pkts_rate><tcp_bytes_per_flow>196</tcp_bytes_per_flow><byte_rate>0.4812182452249951</byte_rate><tcp.tcp_session_payload_up_len>5</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>5</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>4</(-0.001, 150.0]><(150.0, 300.0]>1</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>1</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>1</tcp.psh><tcp.ack>5</tcp.ack><tcp.urg>0</tcp.urg><sport_g>5</sport_g><sport_le>0</sport_le><dport_g>5</dport_g><dport_le>0</dport_le><mean_tcp_pkts>8080</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>8080</min_tcp_pkts><max_tcp_pkts>8080</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>39.2</mean_tcp_len><std_tcp_len>87.65386471799177</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>196</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2053"><ip.session_id>1028</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>6</ip.pkts_per_flow><duration>10.426023006439209</duration><ip.header_len>120</ip.header_len><ip.payload_len>364</ip.payload_len><ip.avg_bytes_tot_len>94.58333333333333</ip.avg_bytes_tot_len><time_between_pkts_sum>0.3466606140136719</time_between_pkts_sum><time_between_pkts_avg>0.05777676900227865</time_between_pkts_avg><time_between_pkts_max>0.2689361572265625</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.10475219931056494</time_between_pkts_std><(-0.001, 50.0]>6</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>6</tcp_pkts_per_flow><pkts_rate>0.5754830961234542</pkts_rate><tcp_bytes_per_flow>164</tcp_bytes_per_flow><byte_rate>0.5754830961234542</byte_rate><tcp.tcp_session_payload_up_len>6</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>6</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>5</(-0.001, 150.0]><(150.0, 300.0]>1</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>1</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>1</tcp.psh><tcp.ack>5</tcp.ack><tcp.urg>0</tcp.urg><sport_g>6</sport_g><sport_le>0</sport_le><dport_g>6</dport_g><dport_le>0</dport_le><mean_tcp_pkts>48192</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>48192</min_tcp_pkts><max_tcp_pkts>48192</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>27.333333333333332</mean_tcp_len><std_tcp_len>66.95271963607352</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>164</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2054"><ip.session_id>1028</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>6</ip.pkts_per_flow><duration>10.426043033599854</duration><ip.header_len>120</ip.header_len><ip.payload_len>531</ip.payload_len><ip.avg_bytes_tot_len>94.58333333333333</ip.avg_bytes_tot_len><time_between_pkts_sum>0.3361701965332031</time_between_pkts_sum><time_between_pkts_avg>0.05602836608886719</time_between_pkts_avg><time_between_pkts_max>0.11897087097167969</time_between_pkts_max><time_between_pkts_min>0.010013580322265625</time_between_pkts_min><time_between_pkts_std>0.04788451829808596</time_between_pkts_std><(-0.001, 50.0]>6</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>6</tcp_pkts_per_flow><pkts_rate>0.5754819906904172</pkts_rate><tcp_bytes_per_flow>331</tcp_bytes_per_flow><byte_rate>0.5754819906904172</byte_rate><tcp.tcp_session_payload_up_len>6</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>6</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>5</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>1</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>1</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>2</tcp.psh><tcp.ack>6</tcp.ack><tcp.urg>0</tcp.urg><sport_g>6</sport_g><sport_le>0</sport_le><dport_g>6</dport_g><dport_le>0</dport_le><mean_tcp_pkts>8080</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>8080</min_tcp_pkts><max_tcp_pkts>8080</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>55.166666666666664</mean_tcp_len><std_tcp_len>132.69576732762303</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>326</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2055"><ip.session_id>1029</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>6</ip.pkts_per_flow><duration>10.391278982162476</duration><ip.header_len>120</ip.header_len><ip.payload_len>513</ip.payload_len><ip.avg_bytes_tot_len>100.58333333333333</ip.avg_bytes_tot_len><time_between_pkts_sum>1.7054080963134766</time_between_pkts_sum><time_between_pkts_avg>0.2842346827189128</time_between_pkts_avg><time_between_pkts_max>0.9150505065917969</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.3598093073506639</time_between_pkts_std><(-0.001, 50.0]>6</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>6</tcp_pkts_per_flow><pkts_rate>0.5774072672189359</pkts_rate><tcp_bytes_per_flow>313</tcp_bytes_per_flow><byte_rate>0.5774072672189359</byte_rate><tcp.tcp_session_payload_up_len>6</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>6</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>5</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>1</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>1</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>1</tcp.psh><tcp.ack>5</tcp.ack><tcp.urg>0</tcp.urg><sport_g>6</sport_g><sport_le>0</sport_le><dport_g>6</dport_g><dport_le>0</dport_le><mean_tcp_pkts>48206</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>48206</min_tcp_pkts><max_tcp_pkts>48206</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>52.166666666666664</mean_tcp_len><std_tcp_len>127.78171491518913</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>313</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2056"><ip.session_id>1029</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>6</ip.pkts_per_flow><duration>10.39128589630127</duration><ip.header_len>120</ip.header_len><ip.payload_len>454</ip.payload_len><ip.avg_bytes_tot_len>100.58333333333333</ip.avg_bytes_tot_len><time_between_pkts_sum>0.4673004150390625</time_between_pkts_sum><time_between_pkts_avg>0.07788340250651042</time_between_pkts_avg><time_between_pkts_max>0.30994415283203125</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.11640284253626723</time_between_pkts_std><(-0.001, 50.0]>6</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>6</tcp_pkts_per_flow><pkts_rate>0.5774068830245227</pkts_rate><tcp_bytes_per_flow>254</tcp_bytes_per_flow><byte_rate>0.5774068830245227</byte_rate><tcp.tcp_session_payload_up_len>6</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>6</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>5</(-0.001, 150.0]><(150.0, 300.0]>1</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>1</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>2</tcp.psh><tcp.ack>6</tcp.ack><tcp.urg>0</tcp.urg><sport_g>6</sport_g><sport_le>0</sport_le><dport_g>6</dport_g><dport_le>0</dport_le><mean_tcp_pkts>8080</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>8080</min_tcp_pkts><max_tcp_pkts>8080</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>42.333333333333336</mean_tcp_len><std_tcp_len>101.26532805786326</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>249</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2057"><ip.session_id>1030</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>6</ip.pkts_per_flow><duration>10.461374998092651</duration><ip.header_len>120</ip.header_len><ip.payload_len>227</ip.payload_len><ip.avg_bytes_tot_len>61.833333333333336</ip.avg_bytes_tot_len><time_between_pkts_sum>0.392913818359375</time_between_pkts_sum><time_between_pkts_avg>0.06548563639322917</time_between_pkts_avg><time_between_pkts_max>0.32806396484375</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.129985290390102</time_between_pkts_std><(-0.001, 50.0]>6</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>6</tcp_pkts_per_flow><pkts_rate>0.5735383734063579</pkts_rate><tcp_bytes_per_flow>27</tcp_bytes_per_flow><byte_rate>0.5735383734063579</byte_rate><tcp.tcp_session_payload_up_len>6</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>6</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>6</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>1</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>1</tcp.psh><tcp.ack>5</tcp.ack><tcp.urg>0</tcp.urg><sport_g>6</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>6</dport_le><mean_tcp_pkts>44948</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>44948</min_tcp_pkts><max_tcp_pkts>44948</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>4.5</mean_tcp_len><std_tcp_len>11.022703842524301</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>27</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2058"><ip.session_id>1030</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>6</ip.pkts_per_flow><duration>10.461451053619385</duration><ip.header_len>120</ip.header_len><ip.payload_len>275</ip.payload_len><ip.avg_bytes_tot_len>61.833333333333336</ip.avg_bytes_tot_len><time_between_pkts_sum>0.3902912139892578</time_between_pkts_sum><time_between_pkts_avg>0.0650485356648763</time_between_pkts_avg><time_between_pkts_max>0.3139972686767578</time_between_pkts_max><time_between_pkts_min>0.010013580322265625</time_between_pkts_min><time_between_pkts_std>0.12209251476329885</time_between_pkts_std><(-0.001, 50.0]>6</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>6</tcp_pkts_per_flow><pkts_rate>0.5735342037397536</pkts_rate><tcp_bytes_per_flow>75</tcp_bytes_per_flow><byte_rate>0.5735342037397536</byte_rate><tcp.tcp_session_payload_up_len>6</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>6</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>6</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>1</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>3</tcp.psh><tcp.ack>6</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>6</sport_le><dport_g>6</dport_g><dport_le>0</dport_le><mean_tcp_pkts>22</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>22</min_tcp_pkts><max_tcp_pkts>22</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>12.5</mean_tcp_len><std_tcp_len>18.92881401461803</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>42</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2059"><ip.session_id>1031</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>6</ip.pkts_per_flow><duration>10.391819953918457</duration><ip.header_len>120</ip.header_len><ip.payload_len>821</ip.payload_len><ip.avg_bytes_tot_len>132.16666666666666</ip.avg_bytes_tot_len><time_between_pkts_sum>0.6198883056640625</time_between_pkts_sum><time_between_pkts_avg>0.10331471761067708</time_between_pkts_avg><time_between_pkts_max>0.5340576171875</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.2114718589532384</time_between_pkts_std><(-0.001, 50.0]>6</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>6</tcp_pkts_per_flow><pkts_rate>0.5773772088629742</pkts_rate><tcp_bytes_per_flow>621</tcp_bytes_per_flow><byte_rate>0.5773772088629742</byte_rate><tcp.tcp_session_payload_up_len>6</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>6</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>5</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>1</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>1</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>1</tcp.psh><tcp.ack>5</tcp.ack><tcp.urg>0</tcp.urg><sport_g>6</sport_g><sport_le>0</sport_le><dport_g>6</dport_g><dport_le>0</dport_le><mean_tcp_pkts>48208</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>48208</min_tcp_pkts><max_tcp_pkts>48208</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>103.5</mean_tcp_len><std_tcp_len>253.52218837805893</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>621</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2060"><ip.session_id>1031</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>6</ip.pkts_per_flow><duration>10.391825914382935</duration><ip.header_len>120</ip.header_len><ip.payload_len>525</ip.payload_len><ip.avg_bytes_tot_len>132.16666666666666</ip.avg_bytes_tot_len><time_between_pkts_sum>2.6540756225585938</time_between_pkts_sum><time_between_pkts_avg>0.44234593709309894</time_between_pkts_avg><time_between_pkts_max>1.7170906066894531</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.7009567154513567</time_between_pkts_std><(-0.001, 50.0]>6</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>6</tcp_pkts_per_flow><pkts_rate>0.5773768776953457</pkts_rate><tcp_bytes_per_flow>325</tcp_bytes_per_flow><byte_rate>0.5773768776953457</byte_rate><tcp.tcp_session_payload_up_len>6</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>6</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>5</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>1</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>1</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>2</tcp.psh><tcp.ack>6</tcp.ack><tcp.urg>0</tcp.urg><sport_g>6</sport_g><sport_le>0</sport_le><dport_g>6</dport_g><dport_le>0</dport_le><mean_tcp_pkts>8080</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>8080</min_tcp_pkts><max_tcp_pkts>8080</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>54.166666666666664</mean_tcp_len><std_tcp_len>130.24656105504923</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>320</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2061"><ip.session_id>1032</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>6</ip.pkts_per_flow><duration>10.391887903213501</duration><ip.header_len>120</ip.header_len><ip.payload_len>379</ip.payload_len><ip.avg_bytes_tot_len>97.08333333333333</ip.avg_bytes_tot_len><time_between_pkts_sum>0.09799003601074219</time_between_pkts_sum><time_between_pkts_avg>0.01633167266845703</time_between_pkts_avg><time_between_pkts_max>0.06198883056640625</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.02434847915186485</time_between_pkts_std><(-0.001, 50.0]>6</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>6</tcp_pkts_per_flow><pkts_rate>0.5773734335745297</pkts_rate><tcp_bytes_per_flow>179</tcp_bytes_per_flow><byte_rate>0.5773734335745297</byte_rate><tcp.tcp_session_payload_up_len>6</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>6</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>5</(-0.001, 150.0]><(150.0, 300.0]>1</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>1</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>1</tcp.psh><tcp.ack>5</tcp.ack><tcp.urg>0</tcp.urg><sport_g>6</sport_g><sport_le>0</sport_le><dport_g>6</dport_g><dport_le>0</dport_le><mean_tcp_pkts>48216</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>48216</min_tcp_pkts><max_tcp_pkts>48216</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>29.833333333333332</mean_tcp_len><std_tcp_len>73.07644399303148</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>179</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2062"><ip.session_id>1032</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>6</ip.pkts_per_flow><duration>10.391894102096558</duration><ip.header_len>120</ip.header_len><ip.payload_len>546</ip.payload_len><ip.avg_bytes_tot_len>97.08333333333333</ip.avg_bytes_tot_len><time_between_pkts_sum>0.7541179656982422</time_between_pkts_sum><time_between_pkts_avg>0.1256863276163737</time_between_pkts_avg><time_between_pkts_max>0.5018711090087891</time_between_pkts_max><time_between_pkts_min>0.006198883056640625</time_between_pkts_min><time_between_pkts_std>0.19772531100815408</time_between_pkts_std><(-0.001, 50.0]>6</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>6</tcp_pkts_per_flow><pkts_rate>0.5773730891647081</pkts_rate><tcp_bytes_per_flow>346</tcp_bytes_per_flow><byte_rate>0.5773730891647081</byte_rate><tcp.tcp_session_payload_up_len>6</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>6</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>5</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>1</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>1</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>2</tcp.psh><tcp.ack>6</tcp.ack><tcp.urg>0</tcp.urg><sport_g>6</sport_g><sport_le>0</sport_le><dport_g>6</dport_g><dport_le>0</dport_le><mean_tcp_pkts>8080</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>8080</min_tcp_pkts><max_tcp_pkts>8080</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>57.666666666666664</mean_tcp_len><std_tcp_len>138.8188267731242</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>341</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2063"><ip.session_id>1033</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>6</ip.pkts_per_flow><duration>10.426023006439209</duration><ip.header_len>120</ip.header_len><ip.payload_len>417</ip.payload_len><ip.avg_bytes_tot_len>89.83333333333333</ip.avg_bytes_tot_len><time_between_pkts_sum>0.4608631134033203</time_between_pkts_sum><time_between_pkts_avg>0.07681051890055339</time_between_pkts_avg><time_between_pkts_max>0.45299530029296875</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.18431186723314755</time_between_pkts_std><(-0.001, 50.0]>6</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>6</tcp_pkts_per_flow><pkts_rate>0.5754830961234542</pkts_rate><tcp_bytes_per_flow>217</tcp_bytes_per_flow><byte_rate>0.5754830961234542</byte_rate><tcp.tcp_session_payload_up_len>6</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>6</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>5</(-0.001, 150.0]><(150.0, 300.0]>1</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>1</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>1</tcp.psh><tcp.ack>5</tcp.ack><tcp.urg>0</tcp.urg><sport_g>6</sport_g><sport_le>0</sport_le><dport_g>6</dport_g><dport_le>0</dport_le><mean_tcp_pkts>48228</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>48228</min_tcp_pkts><max_tcp_pkts>48228</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>36.166666666666664</mean_tcp_len><std_tcp_len>88.58987903065828</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>217</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2064"><ip.session_id>1033</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>6</ip.pkts_per_flow><duration>10.426101922988892</duration><ip.header_len>120</ip.header_len><ip.payload_len>421</ip.payload_len><ip.avg_bytes_tot_len>89.83333333333333</ip.avg_bytes_tot_len><time_between_pkts_sum>4.287958145141602</time_between_pkts_sum><time_between_pkts_avg>0.7146596908569336</time_between_pkts_avg><time_between_pkts_max>2.5620460510253906</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>1.0894908159370946</time_between_pkts_std><(-0.001, 50.0]>6</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>6</tcp_pkts_per_flow><pkts_rate>0.5754787402154953</pkts_rate><tcp_bytes_per_flow>221</tcp_bytes_per_flow><byte_rate>0.5754787402154953</byte_rate><tcp.tcp_session_payload_up_len>6</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>6</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>5</(-0.001, 150.0]><(150.0, 300.0]>1</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>1</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>2</tcp.psh><tcp.ack>6</tcp.ack><tcp.urg>0</tcp.urg><sport_g>6</sport_g><sport_le>0</sport_le><dport_g>6</dport_g><dport_le>0</dport_le><mean_tcp_pkts>8080</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>8080</min_tcp_pkts><max_tcp_pkts>8080</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>36.833333333333336</mean_tcp_len><std_tcp_len>87.79616544397977</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>216</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2065"><ip.session_id>1034</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>5</ip.pkts_per_flow><duration>10.391932010650635</duration><ip.header_len>100</ip.header_len><ip.payload_len>327</ip.payload_len><ip.avg_bytes_tot_len>82.8</ip.avg_bytes_tot_len><time_between_pkts_sum>0.4858970642089844</time_between_pkts_sum><time_between_pkts_avg>0.09717941284179688</time_between_pkts_avg><time_between_pkts_max>0.4379749298095703</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.19066113298626622</time_between_pkts_std><(-0.001, 50.0]>5</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>5</tcp_pkts_per_flow><pkts_rate>0.4811424858126022</pkts_rate><tcp_bytes_per_flow>159</tcp_bytes_per_flow><byte_rate>0.4811424858126022</byte_rate><tcp.tcp_session_payload_up_len>5</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>5</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>4</(-0.001, 150.0]><(150.0, 300.0]>1</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>1</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>1</tcp.psh><tcp.ack>4</tcp.ack><tcp.urg>0</tcp.urg><sport_g>5</sport_g><sport_le>0</sport_le><dport_g>5</dport_g><dport_le>0</dport_le><mean_tcp_pkts>48234</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>48234</min_tcp_pkts><max_tcp_pkts>48234</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>31.8</mean_tcp_len><std_tcp_len>71.10696168449331</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>159</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2066"><ip.session_id>1034</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>5</ip.pkts_per_flow><duration>10.391938924789429</duration><ip.header_len>100</ip.header_len><ip.payload_len>301</ip.payload_len><ip.avg_bytes_tot_len>82.8</ip.avg_bytes_tot_len><time_between_pkts_sum>0.17189979553222656</time_between_pkts_sum><time_between_pkts_avg>0.03437995910644531</time_between_pkts_avg><time_between_pkts_max>0.1251697540283203</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.05117936779680241</time_between_pkts_std><(-0.001, 50.0]>5</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>5</tcp_pkts_per_flow><pkts_rate>0.48114216569082796</pkts_rate><tcp_bytes_per_flow>133</tcp_bytes_per_flow><byte_rate>0.48114216569082796</byte_rate><tcp.tcp_session_payload_up_len>5</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>5</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>5</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>1</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>1</tcp.psh><tcp.ack>5</tcp.ack><tcp.urg>0</tcp.urg><sport_g>5</sport_g><sport_le>0</sport_le><dport_g>5</dport_g><dport_le>0</dport_le><mean_tcp_pkts>8080</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>8080</min_tcp_pkts><max_tcp_pkts>8080</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>26.6</mean_tcp_len><std_tcp_len>59.47940820149441</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>133</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2067"><ip.session_id>1035</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>6</ip.pkts_per_flow><duration>10.391932010650635</duration><ip.header_len>120</ip.header_len><ip.payload_len>365</ip.payload_len><ip.avg_bytes_tot_len>94.75</ip.avg_bytes_tot_len><time_between_pkts_sum>5.277156829833984</time_between_pkts_sum><time_between_pkts_avg>0.8795261383056641</time_between_pkts_avg><time_between_pkts_max>3.865957260131836</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>1.562864698283268</time_between_pkts_std><(-0.001, 50.0]>6</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>6</tcp_pkts_per_flow><pkts_rate>0.5773709829751227</pkts_rate><tcp_bytes_per_flow>165</tcp_bytes_per_flow><byte_rate>0.5773709829751227</byte_rate><tcp.tcp_session_payload_up_len>6</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>6</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>5</(-0.001, 150.0]><(150.0, 300.0]>1</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>1</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>1</tcp.psh><tcp.ack>5</tcp.ack><tcp.urg>0</tcp.urg><sport_g>6</sport_g><sport_le>0</sport_le><dport_g>6</dport_g><dport_le>0</dport_le><mean_tcp_pkts>48248</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>48248</min_tcp_pkts><max_tcp_pkts>48248</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>27.5</mean_tcp_len><std_tcp_len>67.3609679265374</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>165</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2068"><ip.session_id>1035</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>6</ip.pkts_per_flow><duration>10.391948938369751</duration><ip.header_len>120</ip.header_len><ip.payload_len>532</ip.payload_len><ip.avg_bytes_tot_len>94.75</ip.avg_bytes_tot_len><time_between_pkts_sum>1.0149478912353516</time_between_pkts_sum><time_between_pkts_avg>0.1691579818725586</time_between_pkts_avg><time_between_pkts_max>0.7059574127197266</time_between_pkts_max><time_between_pkts_min>0.008106231689453125</time_between_pkts_min><time_between_pkts_std>0.28022193777892807</time_between_pkts_std><(-0.001, 50.0]>6</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>6</tcp_pkts_per_flow><pkts_rate>0.5773700424803335</pkts_rate><tcp_bytes_per_flow>332</tcp_bytes_per_flow><byte_rate>0.5773700424803335</byte_rate><tcp.tcp_session_payload_up_len>6</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>6</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>5</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>1</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>1</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>2</tcp.psh><tcp.ack>6</tcp.ack><tcp.urg>0</tcp.urg><sport_g>6</sport_g><sport_le>0</sport_le><dport_g>6</dport_g><dport_le>0</dport_le><mean_tcp_pkts>8080</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>8080</min_tcp_pkts><max_tcp_pkts>8080</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>55.333333333333336</mean_tcp_len><std_tcp_len>133.10396938734272</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>327</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2069"><ip.session_id>1036</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>10.34406304359436</duration><ip.header_len>20</ip.header_len><ip.payload_len>9</ip.payload_len><ip.avg_bytes_tot_len>29.0</ip.avg_bytes_tot_len><time_between_pkts_sum>0.0030994415283203125</time_between_pkts_sum><time_between_pkts_avg>0.0030994415283203125</time_between_pkts_avg><time_between_pkts_max>0.0030994415283203125</time_between_pkts_max><time_between_pkts_min>0.0030994415283203125</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>1</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>0</tcp_pkts_per_flow><pkts_rate>0.0</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.0</byte_rate><tcp.tcp_session_payload_up_len>0</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>0</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>0</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>0</dport_le><mean_tcp_pkts>0</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>0</min_tcp_pkts><max_tcp_pkts>0</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2070"><ip.session_id>1037</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>6</ip.pkts_per_flow><duration>10.491384983062744</duration><ip.header_len>120</ip.header_len><ip.payload_len>356</ip.payload_len><ip.avg_bytes_tot_len>87.5</ip.avg_bytes_tot_len><time_between_pkts_sum>26.861906051635742</time_between_pkts_sum><time_between_pkts_avg>4.47698434193929</time_between_pkts_avg><time_between_pkts_max>26.83401107788086</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>10.952666748177133</time_between_pkts_std><(-0.001, 50.0]>6</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>6</tcp_pkts_per_flow><pkts_rate>0.5718978008800916</pkts_rate><tcp_bytes_per_flow>156</tcp_bytes_per_flow><byte_rate>0.5718978008800916</byte_rate><tcp.tcp_session_payload_up_len>6</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>6</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>5</(-0.001, 150.0]><(150.0, 300.0]>1</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>1</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>1</tcp.psh><tcp.ack>5</tcp.ack><tcp.urg>0</tcp.urg><sport_g>6</sport_g><sport_le>0</sport_le><dport_g>6</dport_g><dport_le>0</dport_le><mean_tcp_pkts>48250</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>48250</min_tcp_pkts><max_tcp_pkts>48250</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>26</mean_tcp_len><std_tcp_len>63.686733312362634</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>156</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2071"><ip.session_id>1037</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>6</ip.pkts_per_flow><duration>10.491391897201538</duration><ip.header_len>120</ip.header_len><ip.payload_len>454</ip.payload_len><ip.avg_bytes_tot_len>87.5</ip.avg_bytes_tot_len><time_between_pkts_sum>2.3708343505859375</time_between_pkts_sum><time_between_pkts_avg>0.39513905843098956</time_between_pkts_avg><time_between_pkts_max>2.2079944610595703</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>0.8884186578930832</time_between_pkts_std><(-0.001, 50.0]>6</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>6</tcp_pkts_per_flow><pkts_rate>0.5718974239824587</pkts_rate><tcp_bytes_per_flow>254</tcp_bytes_per_flow><byte_rate>0.5718974239824587</byte_rate><tcp.tcp_session_payload_up_len>6</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>6</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>5</(-0.001, 150.0]><(150.0, 300.0]>1</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>1</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>2</tcp.psh><tcp.ack>6</tcp.ack><tcp.urg>0</tcp.urg><sport_g>6</sport_g><sport_le>0</sport_le><dport_g>6</dport_g><dport_le>0</dport_le><mean_tcp_pkts>8080</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>8080</min_tcp_pkts><max_tcp_pkts>8080</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>42.333333333333336</mean_tcp_len><std_tcp_len>101.26532805786326</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>249</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2072"><ip.session_id>1038</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>5</ip.pkts_per_flow><duration>10.46095609664917</duration><ip.header_len>100</ip.header_len><ip.payload_len>229</ip.payload_len><ip.avg_bytes_tot_len>70.2</ip.avg_bytes_tot_len><time_between_pkts_sum>0.7662773132324219</time_between_pkts_sum><time_between_pkts_avg>0.15325546264648438</time_between_pkts_avg><time_between_pkts_max>0.5459785461425781</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.23199722866407174</time_between_pkts_std><(-0.001, 50.0]>5</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>5</tcp_pkts_per_flow><pkts_rate>0.4779677836141181</pkts_rate><tcp_bytes_per_flow>61</tcp_bytes_per_flow><byte_rate>0.4779677836141181</byte_rate><tcp.tcp_session_payload_up_len>5</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>5</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>5</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>1</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>1</tcp.psh><tcp.ack>4</tcp.ack><tcp.urg>0</tcp.urg><sport_g>5</sport_g><sport_le>0</sport_le><dport_g>5</dport_g><dport_le>0</dport_le><mean_tcp_pkts>48260</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>48260</min_tcp_pkts><max_tcp_pkts>48260</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>12.2</mean_tcp_len><std_tcp_len>27.280029325497438</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>61</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2073"><ip.session_id>1038</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>5</ip.pkts_per_flow><duration>10.460967063903809</duration><ip.header_len>100</ip.header_len><ip.payload_len>273</ip.payload_len><ip.avg_bytes_tot_len>70.2</ip.avg_bytes_tot_len><time_between_pkts_sum>2.069711685180664</time_between_pkts_sum><time_between_pkts_avg>0.4139423370361328</time_between_pkts_avg><time_between_pkts_max>1.583099365234375</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.6789703074084432</time_between_pkts_std><(-0.001, 50.0]>5</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>5</tcp_pkts_per_flow><pkts_rate>0.4779672825137552</pkts_rate><tcp_bytes_per_flow>105</tcp_bytes_per_flow><byte_rate>0.4779672825137552</byte_rate><tcp.tcp_session_payload_up_len>5</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>5</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>5</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>1</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>1</tcp.psh><tcp.ack>5</tcp.ack><tcp.urg>0</tcp.urg><sport_g>5</sport_g><sport_le>0</sport_le><dport_g>5</dport_g><dport_le>0</dport_le><mean_tcp_pkts>8080</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>8080</min_tcp_pkts><max_tcp_pkts>8080</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>21</mean_tcp_len><std_tcp_len>46.95742752749558</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>105</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2074"><ip.session_id>1039</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>6</ip.pkts_per_flow><duration>10.461457014083862</duration><ip.header_len>120</ip.header_len><ip.payload_len>365</ip.payload_len><ip.avg_bytes_tot_len>94.75</ip.avg_bytes_tot_len><time_between_pkts_sum>2.2716522216796875</time_between_pkts_sum><time_between_pkts_avg>0.37860870361328125</time_between_pkts_avg><time_between_pkts_max>1.9309520721435547</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.7698702862070408</time_between_pkts_std><(-0.001, 50.0]>6</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>6</tcp_pkts_per_flow><pkts_rate>0.5735338769659358</pkts_rate><tcp_bytes_per_flow>165</tcp_bytes_per_flow><byte_rate>0.5735338769659358</byte_rate><tcp.tcp_session_payload_up_len>6</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>6</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>5</(-0.001, 150.0]><(150.0, 300.0]>1</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>1</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>1</tcp.psh><tcp.ack>5</tcp.ack><tcp.urg>0</tcp.urg><sport_g>6</sport_g><sport_le>0</sport_le><dport_g>6</dport_g><dport_le>0</dport_le><mean_tcp_pkts>48270</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>48270</min_tcp_pkts><max_tcp_pkts>48270</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>27.5</mean_tcp_len><std_tcp_len>67.3609679265374</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>165</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2075"><ip.session_id>1039</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>6</ip.pkts_per_flow><duration>10.4614999294281</duration><ip.header_len>120</ip.header_len><ip.payload_len>532</ip.payload_len><ip.avg_bytes_tot_len>94.75</ip.avg_bytes_tot_len><time_between_pkts_sum>0.6051063537597656</time_between_pkts_sum><time_between_pkts_avg>0.10085105895996094</time_between_pkts_avg><time_between_pkts_max>0.4520416259765625</time_between_pkts_max><time_between_pkts_min>0.010967254638671875</time_between_pkts_min><time_between_pkts_std>0.17291577630297492</time_between_pkts_std><(-0.001, 50.0]>6</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>6</tcp_pkts_per_flow><pkts_rate>0.5735315242054398</pkts_rate><tcp_bytes_per_flow>332</tcp_bytes_per_flow><byte_rate>0.5735315242054398</byte_rate><tcp.tcp_session_payload_up_len>6</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>6</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>5</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>1</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>1</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>2</tcp.psh><tcp.ack>6</tcp.ack><tcp.urg>0</tcp.urg><sport_g>6</sport_g><sport_le>0</sport_le><dport_g>6</dport_g><dport_le>0</dport_le><mean_tcp_pkts>8080</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>8080</min_tcp_pkts><max_tcp_pkts>8080</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>55.333333333333336</mean_tcp_len><std_tcp_len>133.10396938734272</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>327</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2076"><ip.session_id>1040</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>6</ip.pkts_per_flow><duration>10.493793964385986</duration><ip.header_len>120</ip.header_len><ip.payload_len>389</ip.payload_len><ip.avg_bytes_tot_len>90.25</ip.avg_bytes_tot_len><time_between_pkts_sum>1.4922618865966797</time_between_pkts_sum><time_between_pkts_avg>0.24871031443277994</time_between_pkts_avg><time_between_pkts_max>1.3589859008789062</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.5444546930318075</time_between_pkts_std><(-0.001, 50.0]>6</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>6</tcp_pkts_per_flow><pkts_rate>0.5717665146050037</pkts_rate><tcp_bytes_per_flow>189</tcp_bytes_per_flow><byte_rate>0.5717665146050037</byte_rate><tcp.tcp_session_payload_up_len>6</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>6</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>5</(-0.001, 150.0]><(150.0, 300.0]>1</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>1</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>1</tcp.psh><tcp.ack>5</tcp.ack><tcp.urg>0</tcp.urg><sport_g>6</sport_g><sport_le>0</sport_le><dport_g>6</dport_g><dport_le>0</dport_le><mean_tcp_pkts>48284</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>48284</min_tcp_pkts><max_tcp_pkts>48284</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>31.5</mean_tcp_len><std_tcp_len>77.15892689767011</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>189</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2077"><ip.session_id>1040</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>6</ip.pkts_per_flow><duration>10.493798971176147</duration><ip.header_len>120</ip.header_len><ip.payload_len>454</ip.payload_len><ip.avg_bytes_tot_len>90.25</ip.avg_bytes_tot_len><time_between_pkts_sum>0.14495849609375</time_between_pkts_sum><time_between_pkts_avg>0.024159749348958332</time_between_pkts_avg><time_between_pkts_max>0.03814697265625</time_between_pkts_max><time_between_pkts_min>0.0050067901611328125</time_between_pkts_min><time_between_pkts_std>0.014246715444117583</time_between_pkts_std><(-0.001, 50.0]>6</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>6</tcp_pkts_per_flow><pkts_rate>0.5717662418043747</pkts_rate><tcp_bytes_per_flow>254</tcp_bytes_per_flow><byte_rate>0.5717662418043747</byte_rate><tcp.tcp_session_payload_up_len>6</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>6</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>5</(-0.001, 150.0]><(150.0, 300.0]>1</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>1</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>2</tcp.psh><tcp.ack>6</tcp.ack><tcp.urg>0</tcp.urg><sport_g>6</sport_g><sport_le>0</sport_le><dport_g>6</dport_g><dport_le>0</dport_le><mean_tcp_pkts>8080</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>8080</min_tcp_pkts><max_tcp_pkts>8080</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>42.333333333333336</mean_tcp_len><std_tcp_len>101.26532805786326</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>249</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2078"><ip.session_id>1041</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>6</ip.pkts_per_flow><duration>10.49235200881958</duration><ip.header_len>120</ip.header_len><ip.payload_len>366</ip.payload_len><ip.avg_bytes_tot_len>94.91666666666667</ip.avg_bytes_tot_len><time_between_pkts_sum>30.686140060424805</time_between_pkts_sum><time_between_pkts_avg>5.114356676737468</time_between_pkts_avg><time_between_pkts_max>24.058103561401367</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>9.456624287725193</time_between_pkts_std><(-0.001, 50.0]>6</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>6</tcp_pkts_per_flow><pkts_rate>0.571845092020985</pkts_rate><tcp_bytes_per_flow>166</tcp_bytes_per_flow><byte_rate>0.571845092020985</byte_rate><tcp.tcp_session_payload_up_len>6</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>6</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>5</(-0.001, 150.0]><(150.0, 300.0]>1</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>1</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>1</tcp.psh><tcp.ack>5</tcp.ack><tcp.urg>0</tcp.urg><sport_g>6</sport_g><sport_le>0</sport_le><dport_g>6</dport_g><dport_le>0</dport_le><mean_tcp_pkts>48286</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>48286</min_tcp_pkts><max_tcp_pkts>48286</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>27.666666666666668</mean_tcp_len><std_tcp_len>67.76921621700126</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>166</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2079"><ip.session_id>1041</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>6</ip.pkts_per_flow><duration>10.492422103881836</duration><ip.header_len>120</ip.header_len><ip.payload_len>533</ip.payload_len><ip.avg_bytes_tot_len>94.91666666666667</ip.avg_bytes_tot_len><time_between_pkts_sum>0.6742477416992188</time_between_pkts_sum><time_between_pkts_avg>0.11237462361653645</time_between_pkts_avg><time_between_pkts_max>0.3521442413330078</time_between_pkts_max><time_between_pkts_min>0.011205673217773438</time_between_pkts_min><time_between_pkts_std>0.1306799759447565</time_between_pkts_std><(-0.001, 50.0]>6</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>6</tcp_pkts_per_flow><pkts_rate>0.5718412717860641</pkts_rate><tcp_bytes_per_flow>333</tcp_bytes_per_flow><byte_rate>0.5718412717860641</byte_rate><tcp.tcp_session_payload_up_len>6</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>6</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>5</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>1</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>1</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>2</tcp.psh><tcp.ack>6</tcp.ack><tcp.urg>0</tcp.urg><sport_g>6</sport_g><sport_le>0</sport_le><dport_g>6</dport_g><dport_le>0</dport_le><mean_tcp_pkts>8080</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>8080</min_tcp_pkts><max_tcp_pkts>8080</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>55.5</mean_tcp_len><std_tcp_len>133.51217172977152</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>328</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2080"><ip.session_id>1042</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>6</ip.pkts_per_flow><duration>10.492430925369263</duration><ip.header_len>120</ip.header_len><ip.payload_len>360</ip.payload_len><ip.avg_bytes_tot_len>93.91666666666667</ip.avg_bytes_tot_len><time_between_pkts_sum>2.3949146270751953</time_between_pkts_sum><time_between_pkts_avg>0.3991524378458659</time_between_pkts_avg><time_between_pkts_max>1.91497802734375</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.7659284693836431</time_between_pkts_std><(-0.001, 50.0]>6</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>6</tcp_pkts_per_flow><pkts_rate>0.5718407910118161</pkts_rate><tcp_bytes_per_flow>160</tcp_bytes_per_flow><byte_rate>0.5718407910118161</byte_rate><tcp.tcp_session_payload_up_len>6</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>6</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>5</(-0.001, 150.0]><(150.0, 300.0]>1</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>1</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>1</tcp.psh><tcp.ack>5</tcp.ack><tcp.urg>0</tcp.urg><sport_g>6</sport_g><sport_le>0</sport_le><dport_g>6</dport_g><dport_le>0</dport_le><mean_tcp_pkts>48302</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>48302</min_tcp_pkts><max_tcp_pkts>48302</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>26.666666666666668</mean_tcp_len><std_tcp_len>65.31972647421807</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>160</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2081"><ip.session_id>1042</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>6</ip.pkts_per_flow><duration>10.492434978485107</duration><ip.header_len>120</ip.header_len><ip.payload_len>527</ip.payload_len><ip.avg_bytes_tot_len>93.91666666666667</ip.avg_bytes_tot_len><time_between_pkts_sum>1.7168521881103516</time_between_pkts_sum><time_between_pkts_avg>0.2861420313517253</time_between_pkts_avg><time_between_pkts_max>1.2781620025634766</time_between_pkts_max><time_between_pkts_min>0.0040531158447265625</time_between_pkts_min><time_between_pkts_std>0.49386318018132563</time_between_pkts_std><(-0.001, 50.0]>6</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>6</tcp_pkts_per_flow><pkts_rate>0.5718405701158109</pkts_rate><tcp_bytes_per_flow>327</tcp_bytes_per_flow><byte_rate>0.5718405701158109</byte_rate><tcp.tcp_session_payload_up_len>6</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>6</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>5</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>1</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>1</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>2</tcp.psh><tcp.ack>6</tcp.ack><tcp.urg>0</tcp.urg><sport_g>6</sport_g><sport_le>0</sport_le><dport_g>6</dport_g><dport_le>0</dport_le><mean_tcp_pkts>8080</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>8080</min_tcp_pkts><max_tcp_pkts>8080</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>54.5</mean_tcp_len><std_tcp_len>131.06296196866603</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>322</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2082"><ip.session_id>1043</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>7</ip.pkts_per_flow><duration>10.543915033340454</duration><ip.header_len>140</ip.header_len><ip.payload_len>448</ip.payload_len><ip.avg_bytes_tot_len>86.84615384615384</ip.avg_bytes_tot_len><time_between_pkts_sum>46.5700626373291</time_between_pkts_sum><time_between_pkts_avg>6.652866091047015</time_between_pkts_avg><time_between_pkts_max>25.26688575744629</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>10.871882161051234</time_between_pkts_std><(-0.001, 50.0]>7</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>7</tcp_pkts_per_flow><pkts_rate>0.6638900235695759</pkts_rate><tcp_bytes_per_flow>216</tcp_bytes_per_flow><byte_rate>0.6638900235695759</byte_rate><tcp.tcp_session_payload_up_len>7</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>7</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>6</(-0.001, 150.0]><(150.0, 300.0]>1</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>1</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>1</tcp.psh><tcp.ack>6</tcp.ack><tcp.urg>0</tcp.urg><sport_g>7</sport_g><sport_le>0</sport_le><dport_g>7</dport_g><dport_le>0</dport_le><mean_tcp_pkts>48308</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>48308</min_tcp_pkts><max_tcp_pkts>48308</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>30.857142857142858</mean_tcp_len><std_tcp_len>81.64032616999309</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>216</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2083"><ip.session_id>1043</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>6</ip.pkts_per_flow><duration>10.543929100036621</duration><ip.header_len>120</ip.header_len><ip.payload_len>421</ip.payload_len><ip.avg_bytes_tot_len>86.84615384615384</ip.avg_bytes_tot_len><time_between_pkts_sum>0.7450580596923828</time_between_pkts_sum><time_between_pkts_avg>0.1241763432820638</time_between_pkts_avg><time_between_pkts_max>0.3490447998046875</time_between_pkts_max><time_between_pkts_min>0.012874603271484375</time_between_pkts_min><time_between_pkts_std>0.14048980748460296</time_between_pkts_std><(-0.001, 50.0]>6</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>6</tcp_pkts_per_flow><pkts_rate>0.5690478324611611</pkts_rate><tcp_bytes_per_flow>221</tcp_bytes_per_flow><byte_rate>0.5690478324611611</byte_rate><tcp.tcp_session_payload_up_len>6</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>6</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>5</(-0.001, 150.0]><(150.0, 300.0]>1</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>1</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>2</tcp.psh><tcp.ack>6</tcp.ack><tcp.urg>0</tcp.urg><sport_g>6</sport_g><sport_le>0</sport_le><dport_g>6</dport_g><dport_le>0</dport_le><mean_tcp_pkts>8080</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>8080</min_tcp_pkts><max_tcp_pkts>8080</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>36.833333333333336</mean_tcp_len><std_tcp_len>87.79616544397977</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>216</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2084"><ip.session_id>1044</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>5</ip.pkts_per_flow><duration>10.574919939041138</duration><ip.header_len>100</ip.header_len><ip.payload_len>206</ip.payload_len><ip.avg_bytes_tot_len>116.4</ip.avg_bytes_tot_len><time_between_pkts_sum>5.878210067749023</time_between_pkts_sum><time_between_pkts_avg>1.1756420135498047</time_between_pkts_avg><time_between_pkts_max>1.962900161743164</time_between_pkts_max><time_between_pkts_min>0.4069805145263672</time_between_pkts_min><time_between_pkts_std>0.6001653216559232</time_between_pkts_std><(-0.001, 50.0]>5</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>5</tcp_pkts_per_flow><pkts_rate>0.47281681836102546</pkts_rate><tcp_bytes_per_flow>38</tcp_bytes_per_flow><byte_rate>0.47281681836102546</byte_rate><tcp.tcp_session_payload_up_len>5</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>5</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>5</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>1</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>1</tcp.psh><tcp.ack>4</tcp.ack><tcp.urg>0</tcp.urg><sport_g>5</sport_g><sport_le>0</sport_le><dport_g>5</dport_g><dport_le>0</dport_le><mean_tcp_pkts>48312</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>48312</min_tcp_pkts><max_tcp_pkts>48312</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>7.6</mean_tcp_len><std_tcp_len>16.994116628998402</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>38</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2085"><ip.session_id>1044</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>5</ip.pkts_per_flow><duration>10.574937105178833</duration><ip.header_len>100</ip.header_len><ip.payload_len>758</ip.payload_len><ip.avg_bytes_tot_len>116.4</ip.avg_bytes_tot_len><time_between_pkts_sum>0.8549690246582031</time_between_pkts_sum><time_between_pkts_avg>0.17099380493164062</time_between_pkts_avg><time_between_pkts_max>0.6670951843261719</time_between_pkts_max><time_between_pkts_min>0.011920928955078125</time_between_pkts_min><time_between_pkts_std>0.2794393090611009</time_between_pkts_std><(-0.001, 50.0]>5</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>5</tcp_pkts_per_flow><pkts_rate>0.4728160508445355</pkts_rate><tcp_bytes_per_flow>590</tcp_bytes_per_flow><byte_rate>0.4728160508445355</byte_rate><tcp.tcp_session_payload_up_len>5</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>5</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>4</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>1</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>1</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>1</tcp.psh><tcp.ack>5</tcp.ack><tcp.urg>0</tcp.urg><sport_g>5</sport_g><sport_le>0</sport_le><dport_g>5</dport_g><dport_le>0</dport_le><mean_tcp_pkts>8080</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>8080</min_tcp_pkts><max_tcp_pkts>8080</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>118</mean_tcp_len><std_tcp_len>263.8560213449752</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>590</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2086"><ip.session_id>1045</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>7</ip.pkts_per_flow><duration>10.683319091796875</duration><ip.header_len>140</ip.header_len><ip.payload_len>771</ip.payload_len><ip.avg_bytes_tot_len>183.46153846153845</ip.avg_bytes_tot_len><time_between_pkts_sum>7.9936981201171875</time_between_pkts_sum><time_between_pkts_avg>1.1419568743024553</time_between_pkts_avg><time_between_pkts_max>3.827810287475586</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>1.4274845465021406</time_between_pkts_std><(-0.001, 50.0]>7</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>7</tcp_pkts_per_flow><pkts_rate>0.6552270825061202</pkts_rate><tcp_bytes_per_flow>539</tcp_bytes_per_flow><byte_rate>0.6552270825061202</byte_rate><tcp.tcp_session_payload_up_len>7</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>7</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>6</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>1</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>1</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>2</tcp.psh><tcp.ack>6</tcp.ack><tcp.urg>0</tcp.urg><sport_g>7</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>7</dport_le><mean_tcp_pkts>44962</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>44962</min_tcp_pkts><max_tcp_pkts>44962</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>77</mean_tcp_len><std_tcp_len>192.08071220192826</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>512</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2087"><ip.session_id>1045</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>6</ip.pkts_per_flow><duration>10.683332920074463</duration><ip.header_len>120</ip.header_len><ip.payload_len>1354</ip.payload_len><ip.avg_bytes_tot_len>183.46153846153845</ip.avg_bytes_tot_len><time_between_pkts_sum>8.463144302368164</time_between_pkts_sum><time_between_pkts_avg>1.410524050394694</time_between_pkts_avg><time_between_pkts_max>6.477117538452148</time_between_pkts_max><time_between_pkts_min>0.008106231689453125</time_between_pkts_min><time_between_pkts_std>2.551613450472071</time_between_pkts_std><(-0.001, 50.0]>6</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>6</tcp_pkts_per_flow><pkts_rate>0.5616224866236014</pkts_rate><tcp_bytes_per_flow>1154</tcp_bytes_per_flow><byte_rate>0.5616224866236014</byte_rate><tcp.tcp_session_payload_up_len>6</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>6</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>5</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>1</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>1</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>2</tcp.psh><tcp.ack>6</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>6</sport_le><dport_g>6</dport_g><dport_le>0</dport_le><mean_tcp_pkts>22</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>22</min_tcp_pkts><max_tcp_pkts>22</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>192.33333333333334</mean_tcp_len><std_tcp_len>450.8559267290014</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>1112</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2088"><ip.session_id>1046</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>6</ip.pkts_per_flow><duration>10.575835943222046</duration><ip.header_len>120</ip.header_len><ip.payload_len>375</ip.payload_len><ip.avg_bytes_tot_len>89.08333333333333</ip.avg_bytes_tot_len><time_between_pkts_sum>20.779132843017578</time_between_pkts_sum><time_between_pkts_avg>3.463188807169596</time_between_pkts_avg><time_between_pkts_max>19.322872161865234</time_between_pkts_max><time_between_pkts_min>0.010013580322265625</time_between_pkts_min><time_between_pkts_std>7.778721741111612</time_between_pkts_std><(-0.001, 50.0]>6</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>6</tcp_pkts_per_flow><pkts_rate>0.5673310395709518</pkts_rate><tcp_bytes_per_flow>175</tcp_bytes_per_flow><byte_rate>0.5673310395709518</byte_rate><tcp.tcp_session_payload_up_len>6</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>6</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>5</(-0.001, 150.0]><(150.0, 300.0]>1</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>1</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>1</tcp.psh><tcp.ack>5</tcp.ack><tcp.urg>0</tcp.urg><sport_g>6</sport_g><sport_le>0</sport_le><dport_g>6</dport_g><dport_le>0</dport_le><mean_tcp_pkts>48326</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>48326</min_tcp_pkts><max_tcp_pkts>48326</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>29.166666666666668</mean_tcp_len><std_tcp_len>71.44345083117602</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>175</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2089"><ip.session_id>1046</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>6</ip.pkts_per_flow><duration>10.575846910476685</duration><ip.header_len>120</ip.header_len><ip.payload_len>454</ip.payload_len><ip.avg_bytes_tot_len>89.08333333333333</ip.avg_bytes_tot_len><time_between_pkts_sum>0.9167194366455078</time_between_pkts_sum><time_between_pkts_avg>0.1527865727742513</time_between_pkts_avg><time_between_pkts_max>0.5750656127929688</time_between_pkts_max><time_between_pkts_min>0.010967254638671875</time_between_pkts_min><time_between_pkts_std>0.21440920207013045</time_between_pkts_std><(-0.001, 50.0]>6</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>6</tcp_pkts_per_flow><pkts_rate>0.5673304512432246</pkts_rate><tcp_bytes_per_flow>254</tcp_bytes_per_flow><byte_rate>0.5673304512432246</byte_rate><tcp.tcp_session_payload_up_len>6</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>6</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>5</(-0.001, 150.0]><(150.0, 300.0]>1</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>1</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>2</tcp.psh><tcp.ack>6</tcp.ack><tcp.urg>0</tcp.urg><sport_g>6</sport_g><sport_le>0</sport_le><dport_g>6</dport_g><dport_le>0</dport_le><mean_tcp_pkts>8080</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>8080</min_tcp_pkts><max_tcp_pkts>8080</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>42.333333333333336</mean_tcp_len><std_tcp_len>101.26532805786326</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>249</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2090"><ip.session_id>1047</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>6</ip.pkts_per_flow><duration>10.60849905014038</duration><ip.header_len>120</ip.header_len><ip.payload_len>417</ip.payload_len><ip.avg_bytes_tot_len>89.83333333333333</ip.avg_bytes_tot_len><time_between_pkts_sum>33.155202865600586</time_between_pkts_sum><time_between_pkts_avg>5.525867144266765</time_between_pkts_avg><time_between_pkts_max>26.26204490661621</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>10.513300712957685</time_between_pkts_std><(-0.001, 50.0]>6</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>6</tcp_pkts_per_flow><pkts_rate>0.5655842519890316</pkts_rate><tcp_bytes_per_flow>217</tcp_bytes_per_flow><byte_rate>0.5655842519890316</byte_rate><tcp.tcp_session_payload_up_len>6</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>6</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>5</(-0.001, 150.0]><(150.0, 300.0]>1</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>1</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>1</tcp.psh><tcp.ack>5</tcp.ack><tcp.urg>0</tcp.urg><sport_g>6</sport_g><sport_le>0</sport_le><dport_g>6</dport_g><dport_le>0</dport_le><mean_tcp_pkts>48336</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>48336</min_tcp_pkts><max_tcp_pkts>48336</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>36.166666666666664</mean_tcp_len><std_tcp_len>88.58987903065828</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>217</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2091"><ip.session_id>1047</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>6</ip.pkts_per_flow><duration>10.608510971069336</duration><ip.header_len>120</ip.header_len><ip.payload_len>421</ip.payload_len><ip.avg_bytes_tot_len>89.83333333333333</ip.avg_bytes_tot_len><time_between_pkts_sum>0.9446144104003906</time_between_pkts_sum><time_between_pkts_avg>0.15743573506673178</time_between_pkts_avg><time_between_pkts_max>0.415802001953125</time_between_pkts_max><time_between_pkts_min>0.008821487426757812</time_between_pkts_min><time_between_pkts_std>0.16890933583072257</time_between_pkts_std><(-0.001, 50.0]>6</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>6</tcp_pkts_per_flow><pkts_rate>0.5655836164342677</pkts_rate><tcp_bytes_per_flow>221</tcp_bytes_per_flow><byte_rate>0.5655836164342677</byte_rate><tcp.tcp_session_payload_up_len>6</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>6</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>5</(-0.001, 150.0]><(150.0, 300.0]>1</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>1</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>2</tcp.psh><tcp.ack>6</tcp.ack><tcp.urg>0</tcp.urg><sport_g>6</sport_g><sport_le>0</sport_le><dport_g>6</dport_g><dport_le>0</dport_le><mean_tcp_pkts>8080</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>8080</min_tcp_pkts><max_tcp_pkts>8080</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>36.833333333333336</mean_tcp_len><std_tcp_len>87.79616544397977</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>216</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2092"><ip.session_id>1048</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>7</ip.pkts_per_flow><duration>10.788361072540283</duration><ip.header_len>140</ip.header_len><ip.payload_len>771</ip.payload_len><ip.avg_bytes_tot_len>183.46153846153845</ip.avg_bytes_tot_len><time_between_pkts_sum>68.03774833679199</time_between_pkts_sum><time_between_pkts_avg>9.719678333827428</time_between_pkts_avg><time_between_pkts_max>32.89914131164551</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>14.282340842562524</time_between_pkts_std><(-0.001, 50.0]>7</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>7</tcp_pkts_per_flow><pkts_rate>0.6488473970172509</pkts_rate><tcp_bytes_per_flow>539</tcp_bytes_per_flow><byte_rate>0.6488473970172509</byte_rate><tcp.tcp_session_payload_up_len>7</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>7</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>6</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>1</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>1</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>2</tcp.psh><tcp.ack>6</tcp.ack><tcp.urg>0</tcp.urg><sport_g>7</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>7</dport_le><mean_tcp_pkts>44972</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>44972</min_tcp_pkts><max_tcp_pkts>44972</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>77</mean_tcp_len><std_tcp_len>192.08071220192826</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>512</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2093"><ip.session_id>1048</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>6</ip.pkts_per_flow><duration>10.788371086120605</duration><ip.header_len>120</ip.header_len><ip.payload_len>1354</ip.payload_len><ip.avg_bytes_tot_len>183.46153846153845</ip.avg_bytes_tot_len><time_between_pkts_sum>3.6773681640625</time_between_pkts_sum><time_between_pkts_avg>0.6128946940104166</time_between_pkts_avg><time_between_pkts_max>2.6521682739257812</time_between_pkts_max><time_between_pkts_min>0.010013580322265625</time_between_pkts_min><time_between_pkts_std>1.0602413325574196</time_between_pkts_std><(-0.001, 50.0]>6</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>6</tcp_pkts_per_flow><pkts_rate>0.5561543955156573</pkts_rate><tcp_bytes_per_flow>1154</tcp_bytes_per_flow><byte_rate>0.5561543955156573</byte_rate><tcp.tcp_session_payload_up_len>6</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>6</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>5</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>1</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>1</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>2</tcp.psh><tcp.ack>6</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>6</sport_le><dport_g>6</dport_g><dport_le>0</dport_le><mean_tcp_pkts>22</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>22</min_tcp_pkts><max_tcp_pkts>22</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>192.33333333333334</mean_tcp_len><std_tcp_len>450.8559267290014</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>1112</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2094"><ip.session_id>1049</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>6</ip.pkts_per_flow><duration>10.684818983078003</duration><ip.header_len>120</ip.header_len><ip.payload_len>416</ip.payload_len><ip.avg_bytes_tot_len>89.75</ip.avg_bytes_tot_len><time_between_pkts_sum>26.407957077026367</time_between_pkts_sum><time_between_pkts_avg>4.4013261795043945</time_between_pkts_avg><time_between_pkts_max>22.465944290161133</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>8.87399021191338</time_between_pkts_std><(-0.001, 50.0]>6</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>6</tcp_pkts_per_flow><pkts_rate>0.561544375202093</pkts_rate><tcp_bytes_per_flow>216</tcp_bytes_per_flow><byte_rate>0.561544375202093</byte_rate><tcp.tcp_session_payload_up_len>6</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>6</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>5</(-0.001, 150.0]><(150.0, 300.0]>1</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>1</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>1</tcp.psh><tcp.ack>5</tcp.ack><tcp.urg>0</tcp.urg><sport_g>6</sport_g><sport_le>0</sport_le><dport_g>6</dport_g><dport_le>0</dport_le><mean_tcp_pkts>48340</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>48340</min_tcp_pkts><max_tcp_pkts>48340</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>36</mean_tcp_len><std_tcp_len>88.18163074019441</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>216</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2095"><ip.session_id>1049</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>6</ip.pkts_per_flow><duration>10.684829950332642</duration><ip.header_len>120</ip.header_len><ip.payload_len>421</ip.payload_len><ip.avg_bytes_tot_len>89.75</ip.avg_bytes_tot_len><time_between_pkts_sum>1.7039775848388672</time_between_pkts_sum><time_between_pkts_avg>0.2839962641398112</time_between_pkts_avg><time_between_pkts_max>1.2400150299072266</time_between_pkts_max><time_between_pkts_min>0.010967254638671875</time_between_pkts_min><time_between_pkts_std>0.4796000169916608</time_between_pkts_std><(-0.001, 50.0]>6</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>6</tcp_pkts_per_flow><pkts_rate>0.5615437988148054</pkts_rate><tcp_bytes_per_flow>221</tcp_bytes_per_flow><byte_rate>0.5615437988148054</byte_rate><tcp.tcp_session_payload_up_len>6</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>6</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>5</(-0.001, 150.0]><(150.0, 300.0]>1</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>1</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>2</tcp.psh><tcp.ack>6</tcp.ack><tcp.urg>0</tcp.urg><sport_g>6</sport_g><sport_le>0</sport_le><dport_g>6</dport_g><dport_le>0</dport_le><mean_tcp_pkts>8080</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>8080</min_tcp_pkts><max_tcp_pkts>8080</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>36.833333333333336</mean_tcp_len><std_tcp_len>87.79616544397977</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>216</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2096"><ip.session_id>1050</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>6</ip.pkts_per_flow><duration>10.747323036193848</duration><ip.header_len>120</ip.header_len><ip.payload_len>419</ip.payload_len><ip.avg_bytes_tot_len>90.0</ip.avg_bytes_tot_len><time_between_pkts_sum>3.298044204711914</time_between_pkts_sum><time_between_pkts_avg>0.5496740341186523</time_between_pkts_avg><time_between_pkts_max>1.6009807586669922</time_between_pkts_max><time_between_pkts_min>0.0</time_between_pkts_min><time_between_pkts_std>0.6399195835461463</time_between_pkts_std><(-0.001, 50.0]>6</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>6</tcp_pkts_per_flow><pkts_rate>0.5582785573480717</pkts_rate><tcp_bytes_per_flow>219</tcp_bytes_per_flow><byte_rate>0.5582785573480717</byte_rate><tcp.tcp_session_payload_up_len>6</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>6</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>5</(-0.001, 150.0]><(150.0, 300.0]>1</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>1</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>1</tcp.psh><tcp.ack>5</tcp.ack><tcp.urg>0</tcp.urg><sport_g>6</sport_g><sport_le>0</sport_le><dport_g>6</dport_g><dport_le>0</dport_le><mean_tcp_pkts>48356</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>48356</min_tcp_pkts><max_tcp_pkts>48356</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>36.5</mean_tcp_len><std_tcp_len>89.406375611586</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>219</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2097"><ip.session_id>1050</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>6</ip.pkts_per_flow><duration>10.747334957122803</duration><ip.header_len>120</ip.header_len><ip.payload_len>421</ip.payload_len><ip.avg_bytes_tot_len>90.0</ip.avg_bytes_tot_len><time_between_pkts_sum>1.0426044464111328</time_between_pkts_sum><time_between_pkts_avg>0.1737674077351888</time_between_pkts_avg><time_between_pkts_max>0.537872314453125</time_between_pkts_max><time_between_pkts_min>0.010967254638671875</time_between_pkts_min><time_between_pkts_std>0.20514221839764843</time_between_pkts_std><(-0.001, 50.0]>6</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>6</tcp_pkts_per_flow><pkts_rate>0.5582779381062741</pkts_rate><tcp_bytes_per_flow>221</tcp_bytes_per_flow><byte_rate>0.5582779381062741</byte_rate><tcp.tcp_session_payload_up_len>6</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>6</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>5</(-0.001, 150.0]><(150.0, 300.0]>1</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>1</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>2</tcp.psh><tcp.ack>6</tcp.ack><tcp.urg>0</tcp.urg><sport_g>6</sport_g><sport_le>0</sport_le><dport_g>6</dport_g><dport_le>0</dport_le><mean_tcp_pkts>8080</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>8080</min_tcp_pkts><max_tcp_pkts>8080</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>36.833333333333336</mean_tcp_len><std_tcp_len>87.79616544397977</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>216</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2098"><ip.session_id>1051</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>10</ip.pkts_per_flow><duration>10.949920892715454</duration><ip.header_len>200</ip.header_len><ip.payload_len>1155</ip.payload_len><ip.avg_bytes_tot_len>190.94444444444446</ip.avg_bytes_tot_len><time_between_pkts_sum>103.7743091583252</time_between_pkts_sum><time_between_pkts_avg>10.37743091583252</time_between_pkts_avg><time_between_pkts_max>29.226064682006836</time_between_pkts_max><time_between_pkts_min>0.027894973754882812</time_between_pkts_min><time_between_pkts_std>12.739150887460767</time_between_pkts_std><(-0.001, 50.0]>10</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>10</tcp_pkts_per_flow><pkts_rate>0.9132486068143745</pkts_rate><tcp_bytes_per_flow>827</tcp_bytes_per_flow><byte_rate>0.9132486068143745</byte_rate><tcp.tcp_session_payload_up_len>10</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>10</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>8</(-0.001, 150.0]><(150.0, 300.0]>1</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>1</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>1</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>3</tcp.psh><tcp.ack>9</tcp.ack><tcp.urg>0</tcp.urg><sport_g>10</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>10</dport_le><mean_tcp_pkts>44974</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>44974</min_tcp_pkts><max_tcp_pkts>44974</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>82.7</mean_tcp_len><std_tcp_len>177.98380076100557</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>528</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2099"><ip.session_id>1051</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>8</ip.pkts_per_flow><duration>10.920841932296753</duration><ip.header_len>160</ip.header_len><ip.payload_len>1922</ip.payload_len><ip.avg_bytes_tot_len>190.94444444444446</ip.avg_bytes_tot_len><time_between_pkts_sum>16.19863510131836</time_between_pkts_sum><time_between_pkts_avg>2.024829387664795</time_between_pkts_avg><time_between_pkts_max>9.850025177001953</time_between_pkts_max><time_between_pkts_min>0.0069141387939453125</time_between_pkts_min><time_between_pkts_std>3.3446364922701557</time_between_pkts_std><(-0.001, 50.0]>8</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>8</tcp_pkts_per_flow><pkts_rate>0.732544253418887</pkts_rate><tcp_bytes_per_flow>1658</tcp_bytes_per_flow><byte_rate>0.732544253418887</byte_rate><tcp.tcp_session_payload_up_len>8</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>8</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>6</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>1</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>1</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>1</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>3</tcp.psh><tcp.ack>8</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>8</sport_le><dport_g>8</dport_g><dport_le>0</dport_le><mean_tcp_pkts>22</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>22</min_tcp_pkts><max_tcp_pkts>22</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>207.25</mean_tcp_len><std_tcp_len>405.09319915298505</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>1112</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2100"><ip.session_id>1052</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>6</ip.pkts_per_flow><duration>10.82440996170044</duration><ip.header_len>120</ip.header_len><ip.payload_len>418</ip.payload_len><ip.avg_bytes_tot_len>89.91666666666667</ip.avg_bytes_tot_len><time_between_pkts_sum>27.18520164489746</time_between_pkts_sum><time_between_pkts_avg>4.530866940816243</time_between_pkts_avg><time_between_pkts_max>19.20604705810547</time_between_pkts_max><time_between_pkts_min>0.05698204040527344</time_between_pkts_min><time_between_pkts_std>7.465536635940181</time_between_pkts_std><(-0.001, 50.0]>6</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>6</tcp_pkts_per_flow><pkts_rate>0.5543027307012162</pkts_rate><tcp_bytes_per_flow>218</tcp_bytes_per_flow><byte_rate>0.5543027307012162</byte_rate><tcp.tcp_session_payload_up_len>6</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>6</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>5</(-0.001, 150.0]><(150.0, 300.0]>1</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>1</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>1</tcp.psh><tcp.ack>5</tcp.ack><tcp.urg>0</tcp.urg><sport_g>6</sport_g><sport_le>0</sport_le><dport_g>6</dport_g><dport_le>0</dport_le><mean_tcp_pkts>48366</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>48366</min_tcp_pkts><max_tcp_pkts>48366</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>36.333333333333336</mean_tcp_len><std_tcp_len>88.99812732112214</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>218</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2101"><ip.session_id>1052</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>6</ip.pkts_per_flow><duration>10.82442307472229</duration><ip.header_len>120</ip.header_len><ip.payload_len>421</ip.payload_len><ip.avg_bytes_tot_len>89.91666666666667</ip.avg_bytes_tot_len><time_between_pkts_sum>1.4133453369140625</time_between_pkts_sum><time_between_pkts_avg>0.23555755615234375</time_between_pkts_avg><time_between_pkts_max>0.9160041809082031</time_between_pkts_max><time_between_pkts_min>0.013113021850585938</time_between_pkts_min><time_between_pkts_std>0.3504035512938075</time_between_pkts_std><(-0.001, 50.0]>6</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>6</tcp_pkts_per_flow><pkts_rate>0.5543020592027197</pkts_rate><tcp_bytes_per_flow>221</tcp_bytes_per_flow><byte_rate>0.5543020592027197</byte_rate><tcp.tcp_session_payload_up_len>6</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>6</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>5</(-0.001, 150.0]><(150.0, 300.0]>1</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>1</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>2</tcp.psh><tcp.ack>6</tcp.ack><tcp.urg>0</tcp.urg><sport_g>6</sport_g><sport_le>0</sport_le><dport_g>6</dport_g><dport_le>0</dport_le><mean_tcp_pkts>8080</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>8080</min_tcp_pkts><max_tcp_pkts>8080</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>36.833333333333336</mean_tcp_len><std_tcp_len>87.79616544397977</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>216</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2102"><ip.session_id>1053</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>6</ip.pkts_per_flow><duration>10.920996904373169</duration><ip.header_len>120</ip.header_len><ip.payload_len>420</ip.payload_len><ip.avg_bytes_tot_len>90.08333333333333</ip.avg_bytes_tot_len><time_between_pkts_sum>52.67667770385742</time_between_pkts_sum><time_between_pkts_avg>8.779446283976236</time_between_pkts_avg><time_between_pkts_max>28.91993522644043</time_between_pkts_max><time_between_pkts_min>0.04291534423828125</time_between_pkts_min><time_between_pkts_std>13.27826861930743</time_between_pkts_std><(-0.001, 50.0]>6</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>6</tcp_pkts_per_flow><pkts_rate>0.5494003938044685</pkts_rate><tcp_bytes_per_flow>220</tcp_bytes_per_flow><byte_rate>0.5494003938044685</byte_rate><tcp.tcp_session_payload_up_len>6</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>6</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>5</(-0.001, 150.0]><(150.0, 300.0]>1</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>1</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>1</tcp.psh><tcp.ack>5</tcp.ack><tcp.urg>0</tcp.urg><sport_g>6</sport_g><sport_le>0</sport_le><dport_g>6</dport_g><dport_le>0</dport_le><mean_tcp_pkts>48376</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>48376</min_tcp_pkts><max_tcp_pkts>48376</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>36.666666666666664</mean_tcp_len><std_tcp_len>89.81462390204987</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>220</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2103"><ip.session_id>1053</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>6</ip.pkts_per_flow><duration>10.921005964279175</duration><ip.header_len>120</ip.header_len><ip.payload_len>421</ip.payload_len><ip.avg_bytes_tot_len>90.08333333333333</ip.avg_bytes_tot_len><time_between_pkts_sum>1.7702579498291016</time_between_pkts_sum><time_between_pkts_avg>0.2950429916381836</time_between_pkts_avg><time_between_pkts_max>1.3010501861572266</time_between_pkts_max><time_between_pkts_min>0.009059906005859375</time_between_pkts_min><time_between_pkts_std>0.5034839251618412</time_between_pkts_std><(-0.001, 50.0]>6</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>6</tcp_pkts_per_flow><pkts_rate>0.5493999380299781</pkts_rate><tcp_bytes_per_flow>221</tcp_bytes_per_flow><byte_rate>0.5493999380299781</byte_rate><tcp.tcp_session_payload_up_len>6</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>6</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>5</(-0.001, 150.0]><(150.0, 300.0]>1</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>1</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>2</tcp.psh><tcp.ack>6</tcp.ack><tcp.urg>0</tcp.urg><sport_g>6</sport_g><sport_le>0</sport_le><dport_g>6</dport_g><dport_le>0</dport_le><mean_tcp_pkts>8080</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>8080</min_tcp_pkts><max_tcp_pkts>8080</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>36.833333333333336</mean_tcp_len><std_tcp_len>87.79616544397977</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>216</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2104"><ip.session_id>1054</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>7</ip.pkts_per_flow><duration>11.108829975128174</duration><ip.header_len>140</ip.header_len><ip.payload_len>787</ip.payload_len><ip.avg_bytes_tot_len>184.69230769230768</ip.avg_bytes_tot_len><time_between_pkts_sum>58.94327163696289</time_between_pkts_sum><time_between_pkts_avg>8.420467376708984</time_between_pkts_avg><time_between_pkts_max>28.60093116760254</time_between_pkts_max><time_between_pkts_min>0.05507469177246094</time_between_pkts_min><time_between_pkts_std>13.39275519632739</time_between_pkts_std><(-0.001, 50.0]>7</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>7</tcp_pkts_per_flow><pkts_rate>0.630129366969561</pkts_rate><tcp_bytes_per_flow>555</tcp_bytes_per_flow><byte_rate>0.630129366969561</byte_rate><tcp.tcp_session_payload_up_len>7</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>7</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>6</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>1</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>1</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>2</tcp.psh><tcp.ack>6</tcp.ack><tcp.urg>0</tcp.urg><sport_g>7</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>7</dport_le><mean_tcp_pkts>44986</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>44986</min_tcp_pkts><max_tcp_pkts>44986</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>79.28571428571429</mean_tcp_len><std_tcp_len>198.1200934498352</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>528</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2105"><ip.session_id>1054</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>6</ip.pkts_per_flow><duration>11.108844995498657</duration><ip.header_len>120</ip.header_len><ip.payload_len>1354</ip.payload_len><ip.avg_bytes_tot_len>184.69230769230768</ip.avg_bytes_tot_len><time_between_pkts_sum>7.986783981323242</time_between_pkts_sum><time_between_pkts_avg>1.3311306635538738</time_between_pkts_avg><time_between_pkts_max>5.784034729003906</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>2.2479229316266713</time_between_pkts_std><(-0.001, 50.0]>6</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>6</tcp_pkts_per_flow><pkts_rate>0.5401101556850618</pkts_rate><tcp_bytes_per_flow>1154</tcp_bytes_per_flow><byte_rate>0.5401101556850618</byte_rate><tcp.tcp_session_payload_up_len>6</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>6</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>5</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>1</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>1</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>2</tcp.psh><tcp.ack>6</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>6</sport_le><dport_g>6</dport_g><dport_le>0</dport_le><mean_tcp_pkts>22</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>22</min_tcp_pkts><max_tcp_pkts>22</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>192.33333333333334</mean_tcp_len><std_tcp_len>450.8559267290014</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>1112</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2106"><ip.session_id>1055</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>6</ip.pkts_per_flow><duration>10.998389959335327</duration><ip.header_len>120</ip.header_len><ip.payload_len>420</ip.payload_len><ip.avg_bytes_tot_len>90.08333333333333</ip.avg_bytes_tot_len><time_between_pkts_sum>40.219783782958984</time_between_pkts_sum><time_between_pkts_avg>6.703297297159831</time_between_pkts_avg><time_between_pkts_max>36.669015884399414</time_between_pkts_max><time_between_pkts_min>0.027894973754882812</time_between_pkts_min><time_between_pkts_std>14.706311918462953</time_between_pkts_std><(-0.001, 50.0]>6</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>6</tcp_pkts_per_flow><pkts_rate>0.5455343938689188</pkts_rate><tcp_bytes_per_flow>220</tcp_bytes_per_flow><byte_rate>0.5455343938689188</byte_rate><tcp.tcp_session_payload_up_len>6</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>6</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>5</(-0.001, 150.0]><(150.0, 300.0]>1</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>1</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>1</tcp.psh><tcp.ack>5</tcp.ack><tcp.urg>0</tcp.urg><sport_g>6</sport_g><sport_le>0</sport_le><dport_g>6</dport_g><dport_le>0</dport_le><mean_tcp_pkts>48390</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>48390</min_tcp_pkts><max_tcp_pkts>48390</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>36.666666666666664</mean_tcp_len><std_tcp_len>89.81462390204987</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>220</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2107"><ip.session_id>1055</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>6</ip.pkts_per_flow><duration>10.998395919799805</duration><ip.header_len>120</ip.header_len><ip.payload_len>421</ip.payload_len><ip.avg_bytes_tot_len>90.08333333333333</ip.avg_bytes_tot_len><time_between_pkts_sum>1.7452239990234375</time_between_pkts_sum><time_between_pkts_avg>0.29087066650390625</time_between_pkts_avg><time_between_pkts_max>1.2760162353515625</time_between_pkts_max><time_between_pkts_min>0.0059604644775390625</time_between_pkts_min><time_between_pkts_std>0.49565354431749287</time_between_pkts_std><(-0.001, 50.0]>6</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>6</tcp_pkts_per_flow><pkts_rate>0.5455340982223172</pkts_rate><tcp_bytes_per_flow>221</tcp_bytes_per_flow><byte_rate>0.5455340982223172</byte_rate><tcp.tcp_session_payload_up_len>6</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>6</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>5</(-0.001, 150.0]><(150.0, 300.0]>1</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>1</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>2</tcp.psh><tcp.ack>6</tcp.ack><tcp.urg>0</tcp.urg><sport_g>6</sport_g><sport_le>0</sport_le><dport_g>6</dport_g><dport_le>0</dport_le><mean_tcp_pkts>8080</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>8080</min_tcp_pkts><max_tcp_pkts>8080</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>36.833333333333336</mean_tcp_len><std_tcp_len>87.79616544397977</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>216</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2108"><ip.session_id>1056</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>6</ip.pkts_per_flow><duration>11.067953109741211</duration><ip.header_len>120</ip.header_len><ip.payload_len>418</ip.payload_len><ip.avg_bytes_tot_len>89.91666666666667</ip.avg_bytes_tot_len><time_between_pkts_sum>10.448932647705078</time_between_pkts_sum><time_between_pkts_avg>1.741488774617513</time_between_pkts_avg><time_between_pkts_max>6.451845169067383</time_between_pkts_max><time_between_pkts_min>0.21696090698242188</time_between_pkts_min><time_between_pkts_std>2.393051427952264</time_between_pkts_std><(-0.001, 50.0]>6</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>6</tcp_pkts_per_flow><pkts_rate>0.5421056577046062</pkts_rate><tcp_bytes_per_flow>218</tcp_bytes_per_flow><byte_rate>0.5421056577046062</byte_rate><tcp.tcp_session_payload_up_len>6</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>6</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>5</(-0.001, 150.0]><(150.0, 300.0]>1</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>1</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>1</tcp.psh><tcp.ack>5</tcp.ack><tcp.urg>0</tcp.urg><sport_g>6</sport_g><sport_le>0</sport_le><dport_g>6</dport_g><dport_le>0</dport_le><mean_tcp_pkts>48400</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>48400</min_tcp_pkts><max_tcp_pkts>48400</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>36.333333333333336</mean_tcp_len><std_tcp_len>88.99812732112214</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>218</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2109"><ip.session_id>1056</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>6</ip.pkts_per_flow><duration>11.067965984344482</duration><ip.header_len>120</ip.header_len><ip.payload_len>421</ip.payload_len><ip.avg_bytes_tot_len>89.91666666666667</ip.avg_bytes_tot_len><time_between_pkts_sum>1.91497802734375</time_between_pkts_sum><time_between_pkts_avg>0.3191630045572917</time_between_pkts_avg><time_between_pkts_max>1.2249946594238281</time_between_pkts_max><time_between_pkts_min>0.012874603271484375</time_between_pkts_min><time_between_pkts_std>0.4658400250409534</time_between_pkts_std><(-0.001, 50.0]>6</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>6</tcp_pkts_per_flow><pkts_rate>0.5421050271103954</pkts_rate><tcp_bytes_per_flow>221</tcp_bytes_per_flow><byte_rate>0.5421050271103954</byte_rate><tcp.tcp_session_payload_up_len>6</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>6</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>5</(-0.001, 150.0]><(150.0, 300.0]>1</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>1</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>2</tcp.psh><tcp.ack>6</tcp.ack><tcp.urg>0</tcp.urg><sport_g>6</sport_g><sport_le>0</sport_le><dport_g>6</dport_g><dport_le>0</dport_le><mean_tcp_pkts>8080</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>8080</min_tcp_pkts><max_tcp_pkts>8080</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>36.833333333333336</mean_tcp_len><std_tcp_len>87.79616544397977</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>216</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2110"><ip.session_id>1057</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>7</ip.pkts_per_flow><duration>11.217924118041992</duration><ip.header_len>140</ip.header_len><ip.payload_len>787</ip.payload_len><ip.avg_bytes_tot_len>184.69230769230768</ip.avg_bytes_tot_len><time_between_pkts_sum>114.44425582885742</time_between_pkts_sum><time_between_pkts_avg>16.349179404122488</time_between_pkts_avg><time_between_pkts_max>29.323101043701172</time_between_pkts_max><time_between_pkts_min>0.015974044799804688</time_between_pkts_min><time_between_pkts_std>13.050956231253274</time_between_pkts_std><(-0.001, 50.0]>7</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>7</tcp_pkts_per_flow><pkts_rate>0.6240013683763266</pkts_rate><tcp_bytes_per_flow>555</tcp_bytes_per_flow><byte_rate>0.6240013683763266</byte_rate><tcp.tcp_session_payload_up_len>7</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>7</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>6</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>1</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>1</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>2</tcp.psh><tcp.ack>6</tcp.ack><tcp.urg>0</tcp.urg><sport_g>7</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>7</dport_le><mean_tcp_pkts>44996</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>44996</min_tcp_pkts><max_tcp_pkts>44996</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>79.28571428571429</mean_tcp_len><std_tcp_len>198.1200934498352</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>528</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2111"><ip.session_id>1057</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>6</ip.pkts_per_flow><duration>11.217940092086792</duration><ip.header_len>120</ip.header_len><ip.payload_len>1354</ip.payload_len><ip.avg_bytes_tot_len>184.69230769230768</ip.avg_bytes_tot_len><time_between_pkts_sum>8.012056350708008</time_between_pkts_sum><time_between_pkts_avg>1.3353427251180012</time_between_pkts_avg><time_between_pkts_max>5.862951278686523</time_between_pkts_max><time_between_pkts_min>0.009059906005859375</time_between_pkts_min><time_between_pkts_std>2.2813853996235043</time_between_pkts_std><(-0.001, 50.0]>6</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>6</tcp_pkts_per_flow><pkts_rate>0.5348575541272893</pkts_rate><tcp_bytes_per_flow>1154</tcp_bytes_per_flow><byte_rate>0.5348575541272893</byte_rate><tcp.tcp_session_payload_up_len>6</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>6</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>5</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>1</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>1</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>2</tcp.psh><tcp.ack>6</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>6</sport_le><dport_g>6</dport_g><dport_le>0</dport_le><mean_tcp_pkts>22</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>22</min_tcp_pkts><max_tcp_pkts>22</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>192.33333333333334</mean_tcp_len><std_tcp_len>450.8559267290014</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>1112</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2112"><ip.session_id>1058</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>10</ip.pkts_per_flow><duration>11.393008947372437</duration><ip.header_len>200</ip.header_len><ip.payload_len>1147</ip.payload_len><ip.avg_bytes_tot_len>194.41176470588235</ip.avg_bytes_tot_len><time_between_pkts_sum>209.1076374053955</time_between_pkts_sum><time_between_pkts_avg>20.91076374053955</time_between_pkts_avg><time_between_pkts_max>40.548086166381836</time_between_pkts_max><time_between_pkts_min>0.008821487426757812</time_between_pkts_min><time_between_pkts_std>14.937998178972697</time_between_pkts_std><(-0.001, 50.0]>10</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>10</tcp_pkts_per_flow><pkts_rate>0.8777312513483363</pkts_rate><tcp_bytes_per_flow>819</tcp_bytes_per_flow><byte_rate>0.8777312513483363</byte_rate><tcp.tcp_session_payload_up_len>10</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>10</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>8</(-0.001, 150.0]><(150.0, 300.0]>1</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>1</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>1</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>3</tcp.psh><tcp.ack>9</tcp.ack><tcp.urg>0</tcp.urg><sport_g>10</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>10</dport_le><mean_tcp_pkts>45004</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>45004</min_tcp_pkts><max_tcp_pkts>45004</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>81.9</mean_tcp_len><std_tcp_len>175.764014772333</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>520</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2113"><ip.session_id>1058</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>7</ip.pkts_per_flow><duration>11.363296031951904</duration><ip.header_len>140</ip.header_len><ip.payload_len>1818</ip.payload_len><ip.avg_bytes_tot_len>194.41176470588235</ip.avg_bytes_tot_len><time_between_pkts_sum>16.521930694580078</time_between_pkts_sum><time_between_pkts_avg>2.3602758135114397</time_between_pkts_avg><time_between_pkts_max>10.387897491455078</time_between_pkts_max><time_between_pkts_min>0.006198883056640625</time_between_pkts_min><time_between_pkts_std>3.7880481884156247</time_between_pkts_std><(-0.001, 50.0]>7</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>7</tcp_pkts_per_flow><pkts_rate>0.6160184492524913</pkts_rate><tcp_bytes_per_flow>1586</tcp_bytes_per_flow><byte_rate>0.6160184492524913</byte_rate><tcp.tcp_session_payload_up_len>7</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>7</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>5</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>1</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>1</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>1</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>3</tcp.psh><tcp.ack>7</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>7</sport_le><dport_g>7</dport_g><dport_le>0</dport_le><mean_tcp_pkts>22</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>22</min_tcp_pkts><max_tcp_pkts>22</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>226.57142857142858</mean_tcp_len><std_tcp_len>421.4241161992105</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>1112</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2114"><ip.session_id>1059</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>5</ip.pkts_per_flow><duration>11.440372943878174</duration><ip.header_len>100</ip.header_len><ip.payload_len>186</ip.payload_len><ip.avg_bytes_tot_len>75.0</ip.avg_bytes_tot_len><time_between_pkts_sum>46.3099479675293</time_between_pkts_sum><time_between_pkts_avg>9.26198959350586</time_between_pkts_avg><time_between_pkts_max>29.787778854370117</time_between_pkts_max><time_between_pkts_min>1.9609928131103516</time_between_pkts_min><time_between_pkts_std>11.892247450262401</time_between_pkts_std><(-0.001, 50.0]>5</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>5</tcp_pkts_per_flow><pkts_rate>0.4370486892803207</pkts_rate><tcp_bytes_per_flow>18</tcp_bytes_per_flow><byte_rate>0.4370486892803207</byte_rate><tcp.tcp_session_payload_up_len>5</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>5</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>5</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>1</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>1</tcp.psh><tcp.ack>4</tcp.ack><tcp.urg>0</tcp.urg><sport_g>5</sport_g><sport_le>0</sport_le><dport_g>5</dport_g><dport_le>0</dport_le><mean_tcp_pkts>48404</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>48404</min_tcp_pkts><max_tcp_pkts>48404</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>3.6</mean_tcp_len><std_tcp_len>8.049844718999243</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>18</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2115"><ip.session_id>1059</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>5</ip.pkts_per_flow><duration>11.440382957458496</duration><ip.header_len>100</ip.header_len><ip.payload_len>364</ip.payload_len><ip.avg_bytes_tot_len>75.0</ip.avg_bytes_tot_len><time_between_pkts_sum>3.826141357421875</time_between_pkts_sum><time_between_pkts_avg>0.765228271484375</time_between_pkts_avg><time_between_pkts_max>3.33404541015625</time_between_pkts_max><time_between_pkts_min>0.010013580322265625</time_between_pkts_min><time_between_pkts_std>1.4447810877633853</time_between_pkts_std><(-0.001, 50.0]>5</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>5</tcp_pkts_per_flow><pkts_rate>0.43704830673874223</pkts_rate><tcp_bytes_per_flow>196</tcp_bytes_per_flow><byte_rate>0.43704830673874223</byte_rate><tcp.tcp_session_payload_up_len>5</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>5</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>4</(-0.001, 150.0]><(150.0, 300.0]>1</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>1</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>1</tcp.psh><tcp.ack>5</tcp.ack><tcp.urg>0</tcp.urg><sport_g>5</sport_g><sport_le>0</sport_le><dport_g>5</dport_g><dport_le>0</dport_le><mean_tcp_pkts>8080</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>8080</min_tcp_pkts><max_tcp_pkts>8080</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>39.2</mean_tcp_len><std_tcp_len>87.65386471799177</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>196</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2116"><ip.session_id>1060</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>6</ip.pkts_per_flow><duration>11.506385087966919</duration><ip.header_len>120</ip.header_len><ip.payload_len>238</ip.payload_len><ip.avg_bytes_tot_len>76.08333333333333</ip.avg_bytes_tot_len><time_between_pkts_sum>62.99018859863281</time_between_pkts_sum><time_between_pkts_avg>10.498364766438803</time_between_pkts_avg><time_between_pkts_max>29.48784828186035</time_between_pkts_max><time_between_pkts_min>0.03600120544433594</time_between_pkts_min><time_between_pkts_std>14.536729562289295</time_between_pkts_std><(-0.001, 50.0]>6</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>6</tcp_pkts_per_flow><pkts_rate>0.5214496085547011</pkts_rate><tcp_bytes_per_flow>38</tcp_bytes_per_flow><byte_rate>0.5214496085547011</byte_rate><tcp.tcp_session_payload_up_len>6</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>6</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>6</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>1</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>1</tcp.psh><tcp.ack>5</tcp.ack><tcp.urg>0</tcp.urg><sport_g>6</sport_g><sport_le>0</sport_le><dport_g>6</dport_g><dport_le>0</dport_le><mean_tcp_pkts>48416</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>48416</min_tcp_pkts><max_tcp_pkts>48416</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>6.333333333333333</mean_tcp_len><std_tcp_len>15.513435037626795</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>38</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2117"><ip.session_id>1060</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>6</ip.pkts_per_flow><duration>11.50639295578003</duration><ip.header_len>120</ip.header_len><ip.payload_len>435</ip.payload_len><ip.avg_bytes_tot_len>76.08333333333333</ip.avg_bytes_tot_len><time_between_pkts_sum>3.0198097229003906</time_between_pkts_sum><time_between_pkts_avg>0.5033016204833984</time_between_pkts_avg><time_between_pkts_max>2.6459693908691406</time_between_pkts_max><time_between_pkts_min>0.007867813110351562</time_between_pkts_min><time_between_pkts_std>1.0520665818504538</time_between_pkts_std><(-0.001, 50.0]>6</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>0</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>6</tcp_pkts_per_flow><pkts_rate>0.5214492519991687</pkts_rate><tcp_bytes_per_flow>235</tcp_bytes_per_flow><byte_rate>0.5214492519991687</byte_rate><tcp.tcp_session_payload_up_len>6</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>6</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>5</(-0.001, 150.0]><(150.0, 300.0]>1</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>1</tcp.fin><tcp.syn>1</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>2</tcp.psh><tcp.ack>6</tcp.ack><tcp.urg>0</tcp.urg><sport_g>6</sport_g><sport_le>0</sport_le><dport_g>6</dport_g><dport_le>0</dport_le><mean_tcp_pkts>8080</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>8080</min_tcp_pkts><max_tcp_pkts>8080</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>39.166666666666664</mean_tcp_len><std_tcp_len>93.51024899264608</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>230</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2118"><ip.session_id>1062</ip.session_id><meta.direction>0</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>0.5305318832397461</duration><ip.header_len>0</ip.header_len><ip.payload_len>0</ip.payload_len><ip.avg_bytes_tot_len>0.0</ip.avg_bytes_tot_len><time_between_pkts_sum>530.5318832397461</time_between_pkts_sum><time_between_pkts_avg>530.5318832397461</time_between_pkts_avg><time_between_pkts_max>530.5318832397461</time_between_pkts_max><time_between_pkts_min>530.5318832397461</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>0</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>1</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>0</tcp_pkts_per_flow><pkts_rate>0.0</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.0</byte_rate><tcp.tcp_session_payload_up_len>0</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>0</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>0</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>0</dport_le><mean_tcp_pkts>0</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>0</min_tcp_pkts><max_tcp_pkts>0</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
<row _id="2119"><ip.session_id>1063</ip.session_id><meta.direction>1</meta.direction><ip.pkts_per_flow>1</ip.pkts_per_flow><duration>21.11386203765869</duration><ip.header_len>20</ip.header_len><ip.payload_len>193</ip.payload_len><ip.avg_bytes_tot_len>213.0</ip.avg_bytes_tot_len><time_between_pkts_sum>511.354923248291</time_between_pkts_sum><time_between_pkts_avg>511.354923248291</time_between_pkts_avg><time_between_pkts_max>511.354923248291</time_between_pkts_max><time_between_pkts_min>511.354923248291</time_between_pkts_min><time_between_pkts_std>0.0</time_between_pkts_std><(-0.001, 50.0]>0</(-0.001, 50.0]><(50.0, 100.0]>0</(50.0, 100.0]><(100.0, 150.0]>0</(100.0, 150.0]><(150.0, 200.0]>0</(150.0, 200.0]><(200.0, 250.0]>0</(200.0, 250.0]><(250.0, 300.0]>1</(250.0, 300.0]><(300.0, 350.0]>0</(300.0, 350.0]><(350.0, 400.0]>0</(350.0, 400.0]><(400.0, 450.0]>0</(400.0, 450.0]><(450.0, 500.0]>0</(450.0, 500.0]><(500.0, 550.0]>0</(500.0, 550.0]><tcp_pkts_per_flow>0</tcp_pkts_per_flow><pkts_rate>0.0</pkts_rate><tcp_bytes_per_flow>0</tcp_bytes_per_flow><byte_rate>0.0</byte_rate><tcp.tcp_session_payload_up_len>0</tcp.tcp_session_payload_up_len><tcp.tcp_session_payload_down_len>0</tcp.tcp_session_payload_down_len><(-0.001, 150.0]>0</(-0.001, 150.0]><(150.0, 300.0]>0</(150.0, 300.0]><(300.0, 450.0]>0</(300.0, 450.0]><(450.0, 600.0]>0</(450.0, 600.0]><(600.0, 750.0]>0</(600.0, 750.0]><(750.0, 900.0]>0</(750.0, 900.0]><(900.0, 1050.0]>0</(900.0, 1050.0]><(1050.0, 1200.0]>0</(1050.0, 1200.0]><(1200.0, 1350.0]>0</(1200.0, 1350.0]><(1350.0, 1500.0]>0</(1350.0, 1500.0]><(1500.0, 10000.0]>0</(1500.0, 10000.0]><tcp.fin>0</tcp.fin><tcp.syn>0</tcp.syn><tcp.rst>0</tcp.rst><tcp.psh>0</tcp.psh><tcp.ack>0</tcp.ack><tcp.urg>0</tcp.urg><sport_g>0</sport_g><sport_le>0</sport_le><dport_g>0</dport_g><dport_le>0</dport_le><mean_tcp_pkts>0</mean_tcp_pkts><std_tcp_pkts>0</std_tcp_pkts><min_tcp_pkts>0</min_tcp_pkts><max_tcp_pkts>0</max_tcp_pkts><entropy_tcp_pkts>0</entropy_tcp_pkts><mean_tcp_len>0</mean_tcp_len><std_tcp_len>0</std_tcp_len><min_tcp_len>0</min_tcp_len><max_tcp_len>0</max_tcp_len><entropy_tcp_len>0</entropy_tcp_len><ssl.tls_version>0</ssl.tls_version><malware>1</malware></row>
</data>
