---

$boot = (Get-CimInstance Win32_OperatingSystem).LastBootUpTime

Get-WinEvent -FilterHashtable @{
    LogName='Application'
    StartTime=$boot
} -ErrorAction SilentlyContinue |
Select-Object TimeCreated,Id,ProviderName,
    @{N='Data';E={$_.Properties.Value -join ' | '}} |
Where-Object {
    $_.Data -match 'explorer\.exe|userinit\.exe|sihost\.exe|ShellExperienceHost|StartMenuExperienceHost|Iplir|ViPNet|Crypto'
} |
Format-List