Hi.
That does in deed look to be the most possible reason. I've never seen it before, however.
Acording to Windows Update, the last installed update was Definition Update for Windows Defender - KB915597 (Definition 1.127.1171.0), which was installed a day earlier.
What's interesting however, is that when I enitially boot my machine I notice that the TrustedInstaller.exe file usually starts a couple of minutes later, which is apparently part of windows Update. Does this simply run when Windows is actually checking for updates, but not necessarily installing them?
Thanks.