A good start would be to capture a netmon 3.4 trace during the expected time of this traffic, as netmon is usually able to show you which process generated the traffic.
By Any chance is there any software installed on this machine by Lenovo?
We support Ukraine and condemn war. Push Russian government to act against war. Be brave, vocal and show your support to Ukraine. Follow the latest news HERE
