Some assistance/advice needed to research this.
First: I am not sure if this is the right place to ask this. If it isn't please note and I'll close.
Over the weekend my email accounts (yahoo & corporate) were locked because of invalid password.
Looking at one of my laptops (Windows XPSP3), using ProcessHacker.exe I see the process "ntkrnlpa.exe" connected to IP 220.127.116.11. Further looking up that IP points me to:
uk uk lnd london 51.514999 -0.083000 dinsa ministry of defence
What other tool would someone use to inspect this?
Edit: I added some screen shots.