@sysrpl: what does sysinternals process monitor show during this behavior?