Flow 1 risky: tcp 172.16.156.130:50927 -> 10.128.0.243:445
Flow 1 midstream: tcp 172.16.156.130:50927 -> 10.128.0.243:445