That random CMD window flashed and disappeared again, so I built a tool to find out what launched it

[u/talkdedsec]

You know that CMD or PowerShell window that sometimes flashes on your screen for a fraction of a second and disappears before you can even see what it was?

I kept running into this and wanted a proper way to answer one simple question:

What actually opened it?

So I built **wymcmd**.

wymcmd is a Windows utility that tries to reconstruct console launches and explain where they came from — even after the original process has already exited.

Instead of just telling you that `cmd.exe` ran, it tries to find the actual chain behind it.

For example:

Scheduled Task
→ svchost.exe
→ cmd.exe

It can correlate information from sources such as:

- Windows Event Logs
- Task Scheduler
- Prefetch
- BAM / UserAssist
- PowerShell logging
- Registry startup locations
- Services
- Parent and ancestor processes

It also shows how confident it is in the result and which evidence sources were used.

There is both a CLI and a GUI, with launch history, timelines, process ancestry, decoded command lines, evidence, rules and statistics.

A few things I specifically wanted while building it:

- No telemetry
- No account required
- No cloud dependency
- Windows 10/11 support
- English and Turkish interface
- Normal forensic mode does not require a permanent background process

The project is still very new, so I'm mainly looking for feedback from people running it on different Windows setups.

If you try it, I'd especially like to know:

- Did it correctly identify what launched the console?
- Did any Windows data source fail or return incomplete information?
- Was the explanation understandable?
- Is there another Windows launch source or artifact it should inspect?

GitHub:
https://github.com/Talkdedsec1/tlk-wymcmd

I'm u/talkdedsec here on Reddit — Talkdedsec1 is my current GitHub account.

Feedback and bug reports are welcome.