This is just a guess -- being very late to the conversation -- but in case someone even later is curious, this may be the well documented case of the .NET framework recompiling libraries in the background after an update.

It seems like it will never finish, but it does ... eventually. However, the lack of any UI, any indication of its presence or its progress, and also that killing it will just make it come back later are all pretty hostile.

(Google for more info.)

I'm not sure what it is but it's amazingly inefficient: I notice it most when downloading VMs from https://modern.ie because as soon as I start a test VM the updater will run and then it's multiple hours + reboots before a browser in the VM is remotely usable.

Is this a serious statement, that windows update mines Bitcoin?

No - just my boggled speculation about the kind of work which would tie up a modern CPU for hours installing a few GB of files. (SHA-256 could hash each file in a couple seconds)

A MS engineer posted a lengthy blog post on why this is the case. The ridiculous time has to do with insane system state and dependency checking for every update and each one in history before it, since Windows Update allows you to add or remove every little update ever for the OS.

The Rollup updates that MS moved towards, even in Windows 7 now, is supposed to help this. However, a completely new solution is really needed to replace this antiquated one, like many other lingering parts of Windows.

Decompression. They probably weighed compression time vs file size and realized that every byte not downloaded is money saved on bandwidth.

No.

Come to think of it, that's actually an interesting monetization scheme. "You can use our software for free, but when your computer idles, we use x% of its computing power for mining cryptocurrency" (or whatever profitable endeavor). It's of course disastrous from an environmental perspective, but still interesting.

And if it doesn't idle enough, we'll make it.

This is very likely it from my experience as well.