sample.watch
Watch malware run.
Live.
Open suspicious files and links on a disposable machine, take control when they ask for a click, and see every process, file and connection the moment it happens.
Some malware waits for a click.
Here, someone clicks.
From file to verdict while you watch
Bring a file or a link
Pick the machine, the session length and whether it gets internet.
A clean machine runs it
Every collector is recording before the sample starts.
Click when it asks
Take control at any time, add a minute or stop early.
Evidence, not a guess
Indicators link to their events, with coverage next to the score.
One session, every angle
$ curl https://sample.watch/api/v1/tasks \ -H "Authorization: Bearer $SW_KEY" \ -F 'options={"profile":"win11-x64","session_seconds":120}' \ -F file=@invoice_0918.exe # follow it live wss://sample.watch/api/v1/tasks/7f3a9c21/events/ws
A desktop you control
Click past prompts, finish installers and type into fake sign-in pages. Hand control back whenever you like, add a minute, or stop the run early.
Pick the machine the sample expects
Each run gets a fresh, disposable machine. Nothing survives the session.
Windows 11
The desktop most of your users run today.
Windows 10
For samples that check the version or target older fleets.
Linux
ELF binaries and scripts on a disposable server image.
Android
APKs on a phone you drive with taps and swipes.
Built for the analyst in the loop
Decrypted HTTPS
Requests and responses readable next to DNS and flows.
Memory at the end
Executable memory of the sample’s processes, saved when the session stops.
Static analysis
Sections, entropy, imports, signatures and YARA matches.
ATT&CK mapping
Every indicator carries its tactic and technique.
Defanged IOCs
Hashes, domains and IPs ready to copy or export.
Raw artifacts
PCAP, TLS keys, desktop frames and the full event log.