witr for Windows 10 - Full description
witr is an open-source command-line tool for investigating why a process is running and how it started. It is aimed at Windows users who need more context than a standard process list provides, including administrators and anyone troubleshooting software or checking unfamiliar activity. Rather than only showing that a program is active, witr traces the relationships and details that can explain its presence.
To inspect a process, the user supplies its name or process ID (PID). A specific PID focuses the investigation on one running instance, while a general process name can return information about multiple matches. The output shows when the process was launched and exposes its internal settings, flags and handles, giving users clues about its role and how it is being kept running.
The tool also investigates ports, services, containers and individual commands. When a PID is available, witr can follow the process history step by step, tracing what caused it to start and what keeps it active. This helps connect a visible process or service with the activity behind it, rather than treating each running item as an isolated entry.
The command-line format suits users who are comfortable working in a console and want to investigate software startup, process relationships or port activity. Its output can be dense for people unfamiliar with console terminology, so interpreting the details may take some experience. witr is open source and is available for 64-bit Windows 10 and Windows 11.