Last updated
Process Explorer shows you information about which handles and DLLs processes have opened or loaded.
$ winget install --id Microsoft.Sysinternals.ProcessExplorer --exact --version 17.12Run in Command Prompt, PowerShell, or Windows Terminal. Prompts for any agreements.
For IT teams
App deployment, patching, and remote support in one place. Push this app to every device you manage, keep it patched automatically, and see new CVEs the moment they land. Works with Intune or fully standalone.
Sign up freeFree for up to 5 devices.
Ever wondered which program has a particular file or directory open? Now you can find out. Process Explorer shows you information about which handles and DLLs processes have opened or loaded.
The Process Explorer display consists of two sub-windows. The top window always shows a list of the currently active processes, including the names of their owning accounts, whereas the information displayed in the bottom window depends on the mode that Process Explorer is in: if it is in handle mode you'll see the handles that the process selected in the top window has opened; if Process Explorer is in DLL mode you'll see the DLLs and memory-mapped files that the process has loaded. Process Explorer also has a powerful search capability that will quickly show you which processes have particular handles opened or DLLs loaded.
The unique capabilities of Process Explorer make it useful for tracking down DLL-version problems or handle leaks, and provide insight into the way Windows and applications work.
Copy a command tailored to that specific architecture, type, and scope - useful when winget would otherwise pick a different default.
No known CVEs for Process Explorer.
Coverage is best-effort and depends on a winget package mapping to an NVD CPE entry. Absence here is not a guarantee of safety.
More from Sysinternals or browse diagnostics, dll, handle.