of course they are, that's the only people who can do this sort of thing

plus if they are all windows machines (highly likely) then the process is easily hidden, especially if task scheduled to run on idle.