When looking at aggregated logs, you are seeing a large percentage of Windows hosts connecting to an Internet Protocol (IP) address outside the network in a foreign country. Why might this be worth investigating more closely

"It might demonstrate a malware infection" is the correct response.

Explanation:

Because once glancing at aggregate data log files, clients could perhaps actually listen to road conditions but instead correlation coefficient.  For obvious reasons, whenever you see a significant portion of presenters designed to connect to something like a particular destination out beyond your channel, it might have been worthwhile to investigate quite tightly, although it might demonstrate malware.

Need more information