There are a few suspicious files:
taskhost.exe, taskhost.dll, and taskhot.zip
all located under:
C:\Users\_USER_\AppData\Roaming\Microsoft\Windows
When taskhost.exe was running under _USER_ (not local system process), it was consuming about 30% CPU. Seems suspicious to me.