remote interactive session showing from sysinternals logon sessions - not showing in task manager nor any other processes ???hacked?

Question

I have this showing (computername removed) is the results from logonsessions tool from sysinternals - although when I check in taskmgr for anything related to the administrator no remote (rdp) sessions nor any processes running from administrator,

can anyone offer an explanation except stealth hack???

[4] Logon session 00000000:00fcb807:
    User name:    \Administrator
    Auth package: Kerberos
    Logon type:   RemoteInteractive
    Session:      9
    Sid:          S-1-5-21-166797382-3125802628-3585296827-500
    Logon time:   6/08/2019 3:21:30 PM
    Logon server: {COMPUTERNAME}
    DNS Domain:   {DOMAINNAME}.LOCAL
    UPN:          Administrator@{DOMAINNAME}local