wymcmd 0.3.1

A console window flashed on your screen and vanished. This tells you what opened it, and why —
including launches that happened while nothing of ours was running.

Everything in 0.3.0, plus the three below. If you are on 0.3.0 there is no defect here that
affects you; take this one for WYMCMD_HOME and an honest readme.

Install

Download wymcmd-0.3.1-win-x64.zip, unpack it anywhere, then:

wymcmd install

That copies both files to %LOCALAPPDATA%\Programs\wymcmd, adds the folder to your PATH and puts
a shortcut in the start menu — no administrator needed.

The binary is not code-signed, so SmartScreen will call it an unrecognised app the first time:
"More info", then "Run anyway". A .sha256 ships beside every download.

New in 0.3.1

WYMCMD_HOME. Point the database, rules, settings, log and traces at a folder of your
choosing — a stick, a folder for one investigation, a sandbox that gets thrown away afterwards.
Set nothing and nothing changes: the machine-wide folder when it is writable, LocalAppData
otherwise.

The readme is honest about the network. It said an optional hash lookup was off by default.
There is no such feature and no HTTP client anywhere in the binary, so the sentence described
something that could never have been true. It is gone.

The test suite stopped writing into the machine's own data. A test deliberately feeds the rule
loader a broken file to prove it recovers; it was doing that against the real home, so every run
left rules file unreadable, starting empty in the log. That reads exactly like a fault in the
tool, and it never was one.

118 tests.

wymcmd 0.3.0

A console window flashed on your screen and vanished. This tells you what opened it, and why —
including launches that happened while nothing of ours was running.

Install

Download wymcmd-0.3.0-win-x64.zip, unpack it anywhere, then:

wymcmd install

That copies both files to %LOCALAPPDATA%\Programs\wymcmd, adds the folder to your PATH and puts
a shortcut in the start menu — no administrator needed. Open a new terminal and wymcmd works
from any folder.

The binary is not code-signed, so SmartScreen will call it an unrecognised app the first time:
"More info", then "Run anyway". A .sha256 ships beside every download.

Watched, or worked out afterwards

Every answer this tool gives is either something it saw happen or something it rebuilt afterwards
from what Windows kept. It can finally tell you which one you are holding.

wymcmd coverage --last 7d

Capture sessions are recorded with a heartbeat, so a session that ended with the machine losing
power knows to the minute where its coverage stopped instead of claiming it watched a switched-off
computer. Two watchers at once count once.

Blind is not the same as off. An hour with no recording only counts against you if the machine
was up for it, read from the power transitions Windows writes to the System log — no elevation and
no audit policy needed. The percentage is measured against the time the machine was actually on, so
a laptop shut for the weekend is not reported as unwatched.

The black box counts as a watcher. Windows starts it at boot with nothing of ours running, so
it covers exactly the stretches the window cannot. How far back it reaches is read from the oldest
event still in the trace rather than from when the session was created, because the file is
circular and wraps.

wymcmd why says it out loud too: an explanation for a moment nothing was recording is marked as
rebuilt, not read back.

What else a launch now carries

ATT&CK technique names. why and --json label a launch with the MITRE techniques the
evidence already establishes — the scheduled task read out of the task store, the encoded command
that was decoded, the interpreter that actually ran. Nothing is inferred and nothing is scored: a
technique appears only where the finding behind it is in hand, so a launch can be looked up,
matched against a detection rule or pasted into a ticket.

Where it reached. The connections and DNS queries Sysmon recorded for that process while it was
alive. Only Sysmon records this per process; without it the section is absent rather than filled in
from the machine's DNS log, which cannot say which process asked.

Four more places a launch can come from: Active Setup stubs, the Winlogon Shell and Userinit
values, a logon script named in the user's own environment, and a COM server registered per user
that shadows the machine-wide one of the same class.

Also

• Reading a Windows event log is given a time budget, so a machine with a long history cannot hold
  the window while a filtered read walks a log end to end.
• The rules file is no longer written with a second copy of every enabled rule in it.

115 tests. Everything in 0.2.1 is included.

wymcmd 0.2.1

A console window flashed on your screen and vanished. This tells you what opened it, and why —
including launches that happened while nothing of ours was running.

A fix release. Everyone on 0.2.0 should take this one.

Install

Download wymcmd-0.2.1-win-x64.zip, unpack it anywhere, then:

wymcmd install

That copies both files to %LOCALAPPDATA%\Programs\wymcmd, adds the folder to your PATH and puts
a shortcut in the start menu — no administrator needed. Open a new terminal and wymcmd works
from any folder.

The binary is not code-signed, so SmartScreen will call it an unrecognised app the first time:
"More info", then "Run anyway". A .sha256 ships beside every download.

Fixed in 0.2.1

The Sources button froze the app (#1, reported by @mihha). Opening the panel reads the event database, and closing that store waited for its background writer through whatever synchronisation context the caller was on. From the window that context is the WPF dispatcher — which was at that moment blocked inside the very same call. The two waited on each other and nothing could break the tie, so the window never appeared and the process could only be ended from Task Manager.

Closing the window ran the same path, so the app could hang on exit too.

• Closing the event store and the capture engine no longer needs the calling thread back, and every wait is bounded.
• The Sources panel runs its checks off the UI thread and says it is working, so a slow machine draws a window instead of looking frozen.
• The Security log check is given a time budget. Where 4688 auditing was never turned on, asking for the newest one costs a walk of the whole log; it now reports unknown rather than holding the panel up.

A regression test reproduces the freeze on a dispatcher thread and fails without the fix. 80 tests.

Nothing else changed: same sources, same recorder, same command line.

Why My CMD Opened 0.2.0

A console window flashed on your screen and vanished. This tells you what opened it, and why —
including launches that happened while nothing of ours was running.

Install

Download wymcmd-0.2.0-win-x64.zip, unpack it anywhere, then:

wymcmd install

That copies both files to %LOCALAPPDATA%\Programs\wymcmd, adds the folder to your PATH and puts
a shortcut in the start menu — no administrator needed. Open a new terminal and wymcmd works
from any folder.

wymcmd doctor              # what this machine can currently tell you
wymcmd sources enable      # one-time, elevated, fully reversible
wymcmd blackbox on         # the recorder: nothing resident, command lines included
wymcmd why last            # what opened that console?

The binary is not code-signed, so SmartScreen will call it an unrecognised app the first time:
"More info", then "Run anyway". A .sha256 ships beside every download.

New in 0.2.0

The black box records command lines. Kernel-Process events carry none, so there are two ETW
sessions now — the manifest one that works everywhere, and a system trace that does carry the
command line — and the reader merges them. Enabling no longer waits for the next boot: both
sessions start immediately, and still nothing of ours stays resident. wymcmd blackbox read
shows what the recorder is holding.

It forgets on purpose. Retention (30 days, 256 MB by default, in settings.json) runs in the
background when capture starts and on demand with wymcmd prune. Stored ancestor chains dropped
their command lines, which were most of a row's weight.

Prefetch is parsed for real — run count and the last eight run times, straight out of the
compressed file — and AmCache answers when this machine first catalogued a binary, with its
SHA-1. So "runs every morning" and "appeared twenty minutes ago" are now different answers.

The window caught up with the command line: a rules view that shows how often each rule would
have fired and can write one from the selected launch, a timeline view that rebuilds a moment
from every source, and export to CSV, JSON lines or a report.

76 tests and a build workflow that runs them on every push. Writing them turned up a real bug
— FlushAsync threw on an unbounded channel — which is fixed.

ARM64 zip is published as well, built from the same source. No ARM machine runs the test
suite, so treat that one as untested.

Verified on Windows 11 26200

• ETW capture: 500/500 and 300/300 short-lived cmd.exe launches recorded, command lines intact
• Black box: 136 launches read back from the trace, all 136 with a command line
• Retroactive: a console started while nothing of ours ran was reconstructed with its full command
  line and attributed, confidence certain
• Watchdog service: installed, captured, streamed its feed over the named pipe, uninstalled clean

License

Source-available, not open source: free to use, no modification, no redistribution, no resale.

---

Türkçe: Ekranda parlayıp kaybolan konsolu neyin açtığını söyler — hiçbir şeyimiz çalışmıyorken
olmuş açılışlar için de. Zip'i indir, wymcmd install ile PATH'e koy, yeni bir terminalde
wymcmd doctor ile başla. Bu sürümde kara kutu artık komut satırlarını da kaydediyor, veriler
30 gün / 256 MB politikasıyla kendiliğinden budanıyor, Prefetch ve AmCache okunuyor, pencereye
kurallar, zaman tüneli ve dışa aktarma geldi. Arayüz ve çıktılar tamamen Türkçe: --lang tr.

Why My CMD Opened 0.1.1

A console window flashed on your screen and vanished. This tells you what opened it, and why —
including launches that happened while nothing of ours was running.

Install

Download wymcmd-0.1.1-win-x64.zip, unpack it anywhere, then:

wymcmd install

That copies both files to %LOCALAPPDATA%\Programs\wymcmd, adds the folder to your PATH and puts
a shortcut in the start menu — no administrator needed. Open a new terminal and wymcmd works
from any folder. Prefer to keep it portable? Skip the install and run it where you unpacked it.

The two files belong together:

File	What it is
wymcmd.exe	The tool. Double-click it for the window.
wymcmd.com	Console launcher. Windows resolves .com before .exe, so typing wymcmd list runs this, which waits for the tool and returns its exit code.

wymcmd doctor              # what this machine can currently tell you
wymcmd sources enable      # one-time, elevated, fully reversible
wymcmd blackbox on         # optional: never miss anything again, nothing resident
wymcmd why last            # what opened that console?

New in 0.1.1

• wymcmd install — copies the tool to a permanent folder, adds it to the user PATH, creates a
  start menu shortcut. No administrator, and wymcmd uninstall takes it back out.

What it does

• Forensic mode — rebuilds launch history from Security log 4688/4689, Sysmon, Task Scheduler,
  PowerShell script blocks, Prefetch, BAM and UserAssist, with no resident process at all
• Black box — an ETW AutoLogger that Windows itself starts at boot and writes to a capped
  circular trace; wymcmd is not in memory, yet nothing is missed
• Live capture over ETW, with a WMI fallback that says out loud what it can miss
• Attribution — scheduled task by name, Run key, Startup folder, service, WMI subscription,
  IFEO, installer, Office document, browser download, terminal, or you double-clicking
• Decoding — -EncodedCommand turned back into the script, cmd /c unwrapped, the real
  script block pulled from PowerShell logging
• Signatures — Authenticode plus catalog verification, so Windows binaries are never
  mislabelled as unsigned
• Rules with a dry run over recorded history, up to kill-tree, behind a protected-process
  guard no flag can bypass
• Window and CLI in one executable, English and Turkish throughout
• Reversible — wymcmd uninstall --purge reverts every setting it changed and deletes its data

Verified on Windows 11 26200

• ETW capture: 500/500 and 300/300 short-lived cmd.exe launches recorded, command lines intact
• Retroactive: a console started while nothing of ours ran was reconstructed with its full command
  line and attributed, evidence BlackBox, SecurityLog, confidence certain
• Black box: 64 MB circular trace, Get-Process wymcmd empty the whole time

Checksums

wymcmd.exe.sha256 and wymcmd-0.1.1-win-x64.zip.sha256 are attached.

License

Source-available, not open source: free to use, no modification, no redistribution, no resale.

---

Türkçe: Ekranda parlayıp kaybolan konsolu neyin açtığını söyler — üstelik hiçbir şeyimiz
çalışmıyorken olmuş açılışlar için de. Zip'i indir, wymcmd install ile PATH'e koy, yeni bir
terminalde wymcmd doctor ile başla. Arayüz, CLI çıktısı ve raporlar tamamen Türkçe: --lang tr
ya da penceredeki TR anahtarı.

Why My CMD Opened 0.1.0

A console window flashed on your screen and vanished. This tells you what opened it, and why —
including launches that happened while nothing of ours was running.

Install

Download wymcmd-0.1.0-win-x64.zip, unpack it, put the folder on your PATH. Nothing to
install, no runtime to fetch. Keep the two files together:

File	What it is
wymcmd.exe	The tool. Double-click it for the window.
wymcmd.com	Console launcher. Windows resolves .com before .exe, so typing wymcmd list runs this, which waits for the tool and returns its exit code.

wymcmd doctor              # what this machine can currently tell you
wymcmd sources enable      # one-time, elevated, fully reversible
wymcmd blackbox on         # optional: never miss anything again, nothing resident
wymcmd why last            # what opened that console?

In this release

• Forensic mode — rebuilds launch history from Security log 4688/4689, Sysmon, Task Scheduler,
  PowerShell script blocks, Prefetch, BAM and UserAssist, with no resident process at all
• Black box — an ETW AutoLogger that Windows itself starts at boot and writes to a capped
  circular trace; wymcmd is not in memory, yet nothing is missed
• Live capture over ETW, with a WMI fallback that says out loud what it can miss
• Attribution — scheduled task by name, Run key, Startup folder, service, WMI subscription,
  IFEO, installer, Office document, browser download, terminal, or you double-clicking
• Decoding — -EncodedCommand turned back into the script, cmd /c unwrapped, the real
  script block pulled from PowerShell logging
• Signatures — Authenticode plus catalog verification, so Windows binaries are never
  mislabelled as unsigned
• Rules with a dry run over recorded history, up to kill-tree, behind a protected-process
  guard no flag can bypass
• Window and CLI in one executable, English and Turkish throughout
• Reversible — wymcmd uninstall --purge reverts every setting it changed and deletes its data

Verified on Windows 11 26200

• ETW capture: 500/500 and 300/300 short-lived cmd.exe launches recorded, command lines intact
• Retroactive: a console started while nothing of ours ran was reconstructed with its full command
  line and attributed, evidence BlackBox, SecurityLog, confidence certain
• Black box: 64 MB circular trace, Get-Process wymcmd empty the whole time

Checksums

wymcmd.exe.sha256 and wymcmd-0.1.0-win-x64.zip.sha256 are attached.

License

Source-available, not open source: free to use, no modification, no redistribution, no resale.

---

Türkçe: Ekranda parlayıp kaybolan konsolu neyin açtığını söyler — üstelik hiçbir şeyimiz
çalışmıyorken olmuş açılışlar için de. Zip'i indir, klasörü PATH'e ekle, wymcmd doctor ile
başla. Arayüz, CLI çıktısı ve raporlar tamamen Türkçe: --lang tr ya da penceredeki TR anahtarı.