Not sure what might have happened with MBAM, but for the other two scenarios i feel there is really something we don't know yet...
maybe it was only the short cut?........ a diagnostic log from OTL may help!