---

PS C:\Windows\system32> $start = Get-Date
PS C:\Windows\system32> Start-Process "shell:AppsFolder\Microsoft.Windows.Photos_8wekyb3d8bbwe!App"
PS C:\Windows\system32> Start-Sleep -Seconds 3
PS C:\Windows\system32> Get-CimInstance Win32_Process |
>>     Where-Object {
>>         $_.Name -match 'Photos|ApplicationFrameHost|RuntimeBroker'
>>     } |
>>     Select-Object Name, ProcessId, ParentProcessId, ExecutablePath, CommandLine |
>>     Format-List


Name            : RuntimeBroker.exe
ProcessId       : 7648
ParentProcessId : 1120
ExecutablePath  : C:\Windows\System32\RuntimeBroker.exe
CommandLine     : C:\Windows\System32\RuntimeBroker.exe -Embedding

Name            : RuntimeBroker.exe
ProcessId       : 8092
ParentProcessId : 1120
ExecutablePath  : C:\Windows\System32\RuntimeBroker.exe
CommandLine     : C:\Windows\System32\RuntimeBroker.exe -Embedding

Name            : RuntimeBroker.exe
ProcessId       : 9876
ParentProcessId : 1120
ExecutablePath  : C:\Windows\System32\RuntimeBroker.exe
CommandLine     : C:\Windows\System32\RuntimeBroker.exe -Embedding

Name            : RuntimeBroker.exe
ProcessId       : 11968
ParentProcessId : 1120
ExecutablePath  : C:\Windows\System32\RuntimeBroker.exe
CommandLine     : C:\Windows\System32\RuntimeBroker.exe -Embedding

Name            : ApplicationFrameHost.exe
ProcessId       : 5184
ParentProcessId : 1120
ExecutablePath  : C:\Windows\system32\ApplicationFrameHost.exe
CommandLine     : C:\Windows\system32\ApplicationFrameHost.exe -Embedding

Name            : RuntimeBroker.exe
ProcessId       : 6000
ParentProcessId : 1120
ExecutablePath  : C:\Windows\System32\RuntimeBroker.exe
CommandLine     : C:\Windows\System32\RuntimeBroker.exe -Embedding



PS C:\Windows\system32> Write-Host "`n--- Новые события Application ---"

--- Новые события Application ---
PS C:\Windows\system32> Get-WinEvent -FilterHashtable @{
>>     LogName = 'Application'
>>     StartTime = $start
>> } -ErrorAction SilentlyContinue |
>>     Where-Object {
>>         $_.ProviderName -match 'Application Error|Windows Error Reporting|.NET Runtime' -or
>>         $_.Message -match 'Photos.exe|PhotosApp.exe|Microsoft.Windows.Photos'
>>     } |
>>     Select-Object TimeCreated, ProviderName, Id, Message |
>>     Format-List
PS C:\Windows\system32>
PS C:\Windows\system32>