$ErrorActionPreference='Continue'
function B($s){ if($null -eq $s){return ''}; [Convert]::ToBase64String([Text.Encoding]::UTF8.GetBytes([string]$s)) }
$exe = (Get-ChildItem 'C:\Users\Administrator\Desktop' -Recurse -Filter '*.exe' -ErrorAction SilentlyContinue | Where-Object { $_.Name -match '休|眠' } | Select-Object -First 1).FullName
$all = Get-Process -ErrorAction SilentlyContinue | Where-Object { $_.Path -eq $exe }
$pids = @($all.Id)
Write-Output ('实例数: ' + ($all|Measure-Object).Count + ' PIDs: ' + ($pids -join ','))
foreach($p in $all){ Write-Output ('  PID '+$p.Id+' 标题_B64='+(B $p.MainWindowTitle)+' 运行秒='+[int]((Get-Date)-$p.StartTime).TotalSeconds) }
Write-Output '--- 该进程所有TCP连接(含非Established) ---'
Get-NetTCPConnection -ErrorAction SilentlyContinue | Where-Object { $pids -contains $_.OwningProcess -and $_.RemoteAddress -notin '127.0.0.1','::1','0.0.0.0','::' } | ForEach-Object { Write-Output ('  -> '+$_.RemoteAddress+':'+$_.RemotePort+' ['+$_.State+']') }