It primarily runs on Windows 10 64-bit Pro guest VMs, managed by an Ubuntu 22.04 host management layer using Python.

Each sample is typically run for up to 15 minutes to ensure complete behavioral observation, including long-term evasive techniques.

It is noted for its ability to capture executed Assembly (ASM) instructions, record network traffic, and measure start/completion rates for malware samples. System Architecture and Operation