$ErrorActionPreference='Continue'
function B($s){ if($null -eq $s){return ''}; [Convert]::ToBase64String([Text.Encoding]::UTF8.GetBytes([string]$s)) }
Write-Output '===== 当前交互会话 ====='
(qwinsta 2>&1) | ForEach-Object { Write-Output ('SESS_B64=' + (B $_)) }
$exe = (Get-ChildItem 'C:\Users\Administrator\Desktop' -Recurse -Filter '*.exe' -ErrorAction SilentlyContinue | Where-Object { $_.Name -match '休|眠' } | Select-Object -First 1).FullName
Write-Output ('EXE_B64=' + (B $exe))
Write-Output ('启动前已在跑实例数: ' + (Get-Process -ErrorAction SilentlyContinue | Where-Object { $_.Path -eq $exe } | Measure-Object).Count)
Write-Output '===== 启动它(脱离会话) ====='
$r = Invoke-CimMethod -ClassName Win32_Process -MethodName Create -Arguments @{CommandLine=('"'+$exe+'"'); CurrentDirectory=(Split-Path $exe)}
$thePid = $r.ProcessId
Write-Output ('Create ReturnValue=' + $r.ReturnValue + ' PID=' + $thePid)
Start-Sleep 10
$p = Get-Process -Id $thePid -ErrorAction SilentlyContinue
Write-Output ('PID 存活: ' + [bool]$p)
if($p){ Write-Output ('窗口标题_B64=' + (B $p.MainWindowTitle)) }
$all = Get-Process -ErrorAction SilentlyContinue | Where-Object { $_.Path -eq $exe }
Write-Output ('同exe进程数: ' + ($all | Measure-Object).Count + ' PIDs: ' + (($all.Id) -join ','))
Write-Output '===== 对外网络连接(保活心跳判据) ====='
$pids = @($all.Id)
$conns = Get-NetTCPConnection -ErrorAction SilentlyContinue | Where-Object { $pids -contains $_.OwningProcess -and $_.RemoteAddress -notin '127.0.0.1','::1','0.0.0.0' }
if($conns){ $conns | ForEach-Object { Write-Output ('  -> ' + $_.RemoteAddress + ':' + $_.RemotePort + ' [' + $_.State + ']') } }
else { Write-Output '  (无对外连接 —— 可能卡在登录或未联网)' }