User-defined functions.

http://sqlinthewild.co.za/index.php/2009/04/29/functions-io-statistics-and-the-execution-plan/

Or, looking at the duration stats...

Could be different plans. Management studio uses different set options to what most apps use, so running the query from SSMS may have generated a different execution plan, one optimal for the parameters it was run with whereas the app was using a plan generated with other parameters and which is not efficient. Bad parameter sniffing, in other words.