WraithRun is a local-first app for cyber work on Windows. It helps you handle common security tasks on your own PC, with no need to send data to a cloud service.
Use it for:
- reviewing files during an incident
- running local agent tasks
- checking signs of suspicious activity
- supporting threat hunting work
- keeping data on your machine
WraithRun uses Rust for speed and stability. It is built for users who want a desktop tool that stays close to their data.
You need:
- a Windows PC
- an internet connection to download the app
- enough free disk space for the app and your data
- a modern 64-bit version of Windows
For best results, use:
- Windows 10 or Windows 11
- at least 8 GB of RAM
- a recent CPU
- a machine with NPU or GPU support if you plan to use local AI features
Visit the release page here:
Go to the WraithRun releases page
On that page, look for the latest release and download the Windows file that matches your system. If you see more than one file, choose the one for Windows and save it to your computer.
- Open the file you downloaded.
- If Windows asks for permission, choose Yes.
- If the file is a ZIP archive, right-click it and choose Extract All.
- Open the extracted folder.
- Find the WraithRun app file and double-click it to start.
If Windows SmartScreen shows a prompt, choose More info and then Run anyway if you trust the source and want to continue.
When WraithRun starts for the first time:
- Wait a moment while it loads.
- Read any setup screen that appears.
- Choose a local folder for your work files if prompted.
- Allow the app to finish its first-time setup.
- Start with a basic task so you can see how it works.
If the app asks for model files or runtime files, keep the default path unless you have a reason to change it.
WraithRun is built to keep your work local. That means you can use it without sending your data to a remote service.
Common tasks may include:
- loading a case folder
- scanning logs
- reviewing indicators
- running agent tasks
- saving results for later review
Typical flow:
- Open WraithRun.
- Choose the task you want to run.
- Add the file, folder, or data source.
- Start the run.
- Review the output on screen.
- Save anything you want to keep.
For a smoother experience on Windows:
- keep your system updated
- use a fast SSD
- allow enough free space for logs and results
- close apps that use a lot of memory
- use local model support only if your device can handle it
If your PC has NPU or ONNX Runtime support, WraithRun can use that to help with local AI tasks.
WraithRun fits common security work such as:
- incident response
- digital forensics
- threat hunting
- endpoint review
- local agent workflows
- security task automation
It is a good fit when you need to inspect data on the machine where it lives.
After download, you may see files like:
- an
.exefile - a
.zipfile - support files for local runtime use
- folders for logs, cache, or models
If you get a ZIP file, extract it before trying to run the app. If you get an EXE file, double-click it to start.
Try these steps:
- Right-click the app.
- Choose Run as administrator.
- Make sure the file is fully downloaded.
- Check that Windows did not block the file.
- Restart your PC and try again.
This can happen with new apps or files from GitHub releases. If you trust the source, choose the option that lets you continue.
Try this:
- close other heavy apps
- restart the app
- make sure your PC has enough free memory
- use a smaller data set first
- check that your disk has free space
Check that your system has:
- the needed runtime files
- enough memory
- support for the local inference setup
- the right model files if the app asks for them
If you use ONNX or ONNX Runtime, make sure those parts are in place before you start a task that needs them.
WraithRun is local-first. That means your data stays on your machine unless you choose to move it.
This helps when you work with:
- incident files
- case notes
- logs
- forensic data
- security records
You stay in control of where your files go.
For less clutter, keep your work in folders like these:
C:\WraithRun\DownloadsC:\WraithRun\CasesC:\WraithRun\ExportsC:\WraithRun\Models
A simple folder plan makes it easier to find results later.
A good first task is to load a small folder of logs or a test case. This helps you confirm that:
- the app opens
- the interface loads
- files can be read
- results appear on screen
- exports work as expected
Start small before you use larger case data.
You may see a few words in the app that relate to cyber work:
- Agent: a helper that can run tasks for you
- Threat hunting: looking for signs of attack
- Incident response: handling a security event
- Digital forensics: studying files and system data after an event
- ONNX Runtime: software that helps local AI models run
- NPU: a chip part that helps with AI tasks on some devices
WraithRun is a good fit if you want:
- a Windows desktop tool
- local control of files and data
- support for security work
- a fast Rust-based app
- a setup that can work without cloud access
It is best for users who want a simple way to run security tasks on their own computer
Visit the WraithRun releases page and download the latest Windows version, then open the file on your PC