Fecha de publicación: 15/12/2022 Fuente: WIPO (eseential oils OR extracts) A trace information generation device (100) executes malware, which acquires information from an execution environment, a plurality of times while rewriting a value returned by a command of the malware, and thereby extracts, from the malware, an activity trace uniquely determined depending on the execution environment. The trace information generation device (100) creates a program code for reproducing a process related to generation of the extracted activity trace by using a program code of the malware. The trace information generation device (100) generates trace information of a terminal to be monitored by executing the program code.