Download WRAITH
Get the latest Windows release and start triaging in minutes. Choose the guided installer with automatic updates, or the fully portable build. Same app, your call.
How to Install
Pick the install path that fits. Both land you in the same app.
Choose installer or portable
The button above grabs the latest portable
.zipfrom GitHub. Prefer background auto-updates? DownloadWRAITH-win-Setup.exefrom All Releases instead. Only the installer enables in-app updates. The portable build is ideal for USB kits and air-gapped machines.Set it up
Installer: run
WRAITH-win-Setup.exeand launch from the Start Menu shortcut. Portable: right-click the.zip, choose “Extract All,” and drop it anywhere. Nothing is written outside that folder.Run WRAITH.exe
Double-click
WRAITH.exe(portable) or the Start Menu shortcut (installer). Everything is self-contained. The .NET runtime is bundled, so there's no SDK or Python to install. Expect a UAC prompt; administrator access is required to read protected artifacts.
What Windows Will Tell You
These prompts are expected. Here is what each one means and what to do.
“Windows protected your PC”
You will likely see this the first time you run WRAITH. It appears because WRAITH does not have a commercially purchased code signing certificate. To continue, click More info and then Run anyway. This is a one-time prompt for new executables from the internet.
“Do you want to allow this app to make changes?”
WRAITH requests administrator privileges. This is needed to read protected artifacts like event logs, some registry keys, and process data that require elevated access, and to take action on threats, such as killing a live process or quarantining a file. Click Yes to continue.
Flagged as suspicious
Some antivirus tools flag WRAITH because it reads and inspects the same types of system artifacts that malware sometimes touches. This is a false positive. WRAITH is fully open source and every line of code is on GitHub. If it gets quarantined, you can review the code yourself and add an exclusion for the WRAITH folder.
About Code Signing
Why there is no certificate, and what that means for you.
WRAITH is not currently signed with a commercial Authenticode certificate. The honest reason: code signing certificates for Windows desktop apps cost a few hundred dollars per year, and this is a community project with no budget behind it. The absence of a certificate is a cost issue, not a security issue.
If you want to verify what you are running, the source code is entirely public on GitHub. You can review it, build it yourself, and compare the binary hash to the one in the release. That is more transparent than a paid certificate from a company you have never heard of anyway.
Getting a proper Authenticode certificate is on the roadmap. When that ships, Windows will recognize WRAITH as a trusted publisher and the SmartScreen prompt will go away.