I tracked it to a dllhost.exe I believe, and then "in" the dllhost the acutal process name was just a bunch of random characters. I searched for the string of characters online, and it lead me to something about DCOM and thumbnails. edit: it was dllhost.exe (6044) which the command line section in performance analyzer said "C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}". That process id leads to "Thumbnail Cache Out of Proc Server DCOM entry". Since this is an HTPC, and not a desktop, I really don't care about thumbnails, so I just disabled them, and cut my time to 1/3 of what it was.