NKAMG Sandbox / Secure intake
Turn unknown files into kernel-level evidence.
Submit a suspicious file to an isolated Windows Guest. NKAMG preserves static structure, user-mode behavior, kernel callbacks, service and driver activity, IOCTL paths, and BYOVD impact before assembling a readable report.
Isolated Windows Guest execution
Static PE structure and import review
User-mode API and process behavior
Kernel callbacks and driver loads
IOCTL paths and BYOVD impact
ATT&CK mapping and readable reports
Secure intake
NKAMG analysis eagle / secure intake
Awaiting sample
Select a file and enter your upload key.
Protected access
Retrieve a report.
Each submission returns a one-time access token. A report can be opened only with its task ID and matching token; the public service does not expose a task collection endpoint.
Open a saved report
Use the credentials shown immediately after submission or saved by this browser.
Tokens are stored only in this browser when a task is submitted here. Clearing site data removes local task credentials.