How to tell what program is using Windows Based Script Host?

I regularly have Microsoft ® Windows Based Script Host (located at C:\Windows\SysWOW64\wscript.exe) popping in my Task Manager and using a lot of CPU. From my understanding this software is used by third-party scripts. Is there any way to have more detail about what script is using it?

I'm using Windows 10 by the way. And I don't want to disable it altogether because I need it for Python virtual environments.

2 Answers

wscript.exe is also known as Windows Script Host, a service that provides the Windows system with scripting abilities ,generally VBscript and JScript.

In Powershell, you can run this to see all running Wscript.exe instances and their command line:

Get-WMIObject Win32_Process | Where-Object {$_.Name -match ".*wscript.exe.*"} | Select-Object Name,CommandLine

CommandLine is the file location of the wscript.exe instance script.

You can also check what you want as processes, just put them into an array and execute this powershell script :

$Processes = @("cmd","mshta","wscript","cscript","powershell")
ForEach ($Process in $Processes)
{ GWMI Win32_Process | ? {$_.Name -match ".*$Process*"} | Select Handle,Name,CommandLine
}