This sounds like a program that would be constantly running in the background of a computer. Would this program be launched by the user? Or would it be automatically started on computer start (which is malicious). If you could provide more information on this program, I can help with all of the above (Process tree monitoring may be the only thing that would seem difficult to me).