FWIW, that USER32 entry is identical to one in my system log after automatic updates were installed. But immediately before that there are several events from Windows Update Agent and NtServicePack...