Skip to content

Why My CMD Opened 0.1.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 24 Aug 11:27
· 24 commits to main since this release
v0.1.0
57b40f0

A console window flashed on your screen and vanished. This tells you what opened it, and why —
including launches that happened while nothing of ours was running.

Install

Download wymcmd-0.1.0-win-x64.zip, unpack it, put the folder on your PATH. Nothing to
install, no runtime to fetch. Keep the two files together:

File What it is
wymcmd.exe The tool. Double-click it for the window.
wymcmd.com Console launcher. Windows resolves .com before .exe, so typing wymcmd list runs this, which waits for the tool and returns its exit code. 
wymcmd doctor              # what this machine can currently tell you
wymcmd sources enable      # one-time, elevated, fully reversible
wymcmd blackbox on         # optional: never miss anything again, nothing resident
wymcmd why last            # what opened that console?

In this release

  • Forensic mode — rebuilds launch history from Security log 4688/4689, Sysmon, Task Scheduler,
    PowerShell script blocks, Prefetch, BAM and UserAssist, with no resident process at all
  • Black box — an ETW AutoLogger that Windows itself starts at boot and writes to a capped
    circular trace; wymcmd is not in memory, yet nothing is missed
  • Live capture over ETW, with a WMI fallback that says out loud what it can miss
  • Attribution — scheduled task by name, Run key, Startup folder, service, WMI subscription,
    IFEO, installer, Office document, browser download, terminal, or you double-clicking
  • Decoding — -EncodedCommand turned back into the script, cmd /c unwrapped, the real
    script block pulled from PowerShell logging
  • Signatures — Authenticode plus catalog verification, so Windows binaries are never
    mislabelled as unsigned
  • Rules with a dry run over recorded history, up to kill-tree, behind a protected-process
    guard no flag can bypass
  • Window and CLI in one executable, English and Turkish throughout
  • Reversible — wymcmd uninstall --purge reverts every setting it changed and deletes its data

Verified on Windows 11 26200

  • ETW capture: 500/500 and 300/300 short-lived cmd.exe launches recorded, command lines intact
  • Retroactive: a console started while nothing of ours ran was reconstructed with its full command
    line and attributed, evidence BlackBox, SecurityLog, confidence certain
  • Black box: 64 MB circular trace, Get-Process wymcmd empty the whole time

Checksums

wymcmd.exe.sha256 and wymcmd-0.1.0-win-x64.zip.sha256 are attached.

License

Source-available, not open source: free to use, no modification, no redistribution, no resale.

Türkçe: Ekranda parlayıp kaybolan konsolu neyin açtığını söyler — üstelik hiçbir şeyimiz
çalışmıyorken olmuş açılışlar için de. Zip'i indir, klasörü PATH'e ekle, wymcmd doctor ile
başla. Arayüz, CLI çıktısı ve raporlar tamamen Türkçe: --lang tr ya da penceredeki TR anahtarı.

Assets 7
Loading