|
Time |
Victim OS |
Infection Source |
C&C Server |
DNS Lookups & Failed Connects |
Infection Port |
Packet Trace |
Detection Signatures |
Infection Chatter |
BotHunter Analysis |
Behavioral Cluster |
Forensic Logs |
Antivirus Labels |
Packed Malware_Binary |
Unpacked egg.exe |
Unpacked egg.asm |
Packer PEID |
Data Strings |
Syscall Trace |
| T:00:41:00 | Win2K-f | 208.127.63.5 (DSLEXTREME.COM): DSL EXTREME, VISTA, CALIFORNIA, US. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 76 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 33 |
53bfe15e91 NEW a08f3b74a4 NEW |
1473091351 [0] none [0] |
ASM:Graph none:none |
tElock| Armadillo| |
lines=75 embedded dns lines=90 |
trace trace |
| T:01:29:00 | Win2K-f | 114.206.34.36 (-): HANARO TELECOM, SEOUL, SEOUL-T'UKPYOLSI, KR. (DSL) |
193.104.94.11:65520 | US:microsoft.com DE:proxim.ircgalaxy.pl CN:www.liagand.cn CN:down1130.iwillhavesexygirls.com CN:1130.kfgrtjer.cn :wws.mobiec.net CN:russia.2288.org CN:210.51.36.215:88 98.126.9.218:80 |
135 | pcap | raw alerts ruleset |
irc http 119 lines |
Yeah : 1.8 profile |
none | summary tarball |
29 of 32 28 of 32 20 of 41 |
8a75955033 NEW 9276c8b36b NEW f1ac647184 NEW |
2bf3e548b9 [0] none [0] none [none] |
ASM:Graph ASM:Graph none:none |
tElock| Armadillo| none|none |
lines=126 embedded dns lines=81 none |
trace trace none |
| T:02:09:00 | Win2K-f | 65.6.132.38 (BELLSOUTH.NET): BELLSOUTH.NET INC, ATLANTA, GEORGIA, US. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 148 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 33 |
53bfe15e91 NEW a08f3b74a4 NEW |
1473091351 [0] none [0] |
ASM:Graph none:none |
tElock| Armadillo| |
lines=75 embedded dns lines=90 |
trace trace |
| T:05:12:00 | WinXP | 92.47.56.145 (METRO.ONLINE.KZ): JSC KAZAKHTELECOM AKTOBE AFFILIATE, ALMATY, ALMATY CITY, KZ. (DSL) |
n/a | DE:ilo.brenz.pl RU:citi-bank.ru FR:193.104.94.11:80 RU:213.219.245.212:80 |
445 | pcap | raw alerts ruleset |
http 4 lines |
Yeah : 0.8 profile |
none | summary tarball |
34 of 41 | 987483e54a NEW |
none[none] | none:none |
none|none | none | none |
| T:05:52:00 | WinXP | 62.215.27.136 (-): FAST TELCO CUSTOMER ACCESS SERVERS, KUWAIT, AL KUWAYT, KW. (DSL) |
213.219.245.212:80 | RU:citi-bank.ru | 445 | pcap | raw alerts ruleset |
http 2 lines |
Yeah : 1.3 profile |
none | summary tarball |
26 of 28 | 7d99b0e910 NEW |
none[0] | none:none |
PolyEnE| | lines=68 | trace |
| T:06:15:00 | Win2K-f | 204.181.130.98 (UNINETS.NET): OXFORD COUNTY TELEPHONE SERVICE / THE PHONE STORE/MEGALINK, GREENWOOD, MAINE, US. (DSL) |
n/a | 135 | pcap | raw alerts ruleset |
other 186 lines |
Yeah : 1.3 profile |
none | summary tarball |
40 of 41 | fb66246b60 NEW |
none[none] | none:none |
none|none | none | none | |
| T:06:26:00 | Win2K-f | 174.1.101.96 (SHAWCABLE.NET): SHAW COMMUNICATIONS INC, WINNIPEG, MANITOBA, CA. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 75 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 33 |
53bfe15e91 NEW a08f3b74a4 NEW |
1473091351 [0] none [0] |
ASM:Graph none:none |
tElock| Armadillo| |
lines=75 embedded dns lines=90 |
trace trace |
| 08:10:00 | WinXP | 110.14.214.164 (-): HANARO TELECOM, SEOUL, SEOUL-T'UKPYOLSI, KR. (DSL) |
88.198.228.238:65520 | DE:proxim.ircgalaxy.pl US:microsoft.com CN:av.lometr.pl CN:down1130.iwillhavesexygirls.com CN:1130.kfgrtjer.cn :bfkq.com :jsactivity.com :wws.mobiec.net CN:russia.2288.org US:search.toptravellingtips.com US:search.articleswave.co.uk US:208.43.250.167:80 CN:61.235.117.71:80 US:66.96.221.101:8392 |
135 | pcap | raw alerts ruleset |
irc http 218 lines |
Yeah : 1.8 profile |
none | summary tarball |
7 of 39 37 of 41 10 of 41 38 of 41 13 of 41 0 of 40 26 of 41 20 of 41 |
4b7cd8e5ae NEW 598636aa73 NEW 62068d3faf NEW a57ddcdef0 NEW a836ced040 NEW bfa58926f3 NEW dd96e88e03 NEW f1ac647184 NEW |
none[none] 613af3f9a2[0] none [none] none [4] none [none] none [none] 6f87541765[0] none [none] |
none:none none:none none:none none:none none:none none:none none:none none:none |
none|none Armadillo| none|none PolyEnE| none|none none|none StarForce| none|none |
none none none none none none none none |
none trace none trace none none trace none |
| T:08:12:00 | WinXP | 119.230.61.184 (EONET.NE.JP): K-OPTICOM CORPORATION, OSAKA, OSAKA, JP. (DSL) |
n/a | 445 | pcap | raw alerts ruleset |
shell ftp 14 lines |
Yeah : 1.3 profile |
none | summary tarball |
32 of 32 | 03f912899b NEW |
none[0] | none:none |
none|none | lines=64 | trace | |
| T:09:37:00 | Win2K-f | 174.3.75.74 (SHAWCABLE.NET): SHAW COMMUNICATIONS INC, TORONTO, ONTARIO, CA. (100Mbps) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 222 lines |
Yeah : 1.3 profile |
none | summary tarball |
37 of 41 38 of 41 |
4180c19d91 NEW b6e91e001c NEW |
9f3f2de385 [0] d2275a6cf5[0] |
none:none none:none |
Armadillo| PolyEnE| |
none none |
trace trace |
| 10:09:00 | WinXP | 4.90.18.30 (LEVEL3.NET): LEVEL 3 COMMUNICATIONS INC, NEW YORK, NEW YORK, US. (DIAL) |
213.219.245.212:80 | RU:citi-bank.ru | 445 | pcap | raw alerts ruleset |
http 2 lines |
Yeah : 1.3 profile |
none | summary tarball |
39 of 41 | c1868a3b2b NEW |
05bc798a8d [none] | none:none |
PolyEnE| | none | none |
| T:10:44:00 | WinXP | 93.112.60.86 (ZAPPMOBILE.RO): TELEMOBIL S.A, RO. (DSL) |
213.219.245.212:80 | RU:citi-bank.ru | 445 | pcap | raw alerts ruleset |
http 2 lines |
Yeah : 1.3 profile |
none | summary tarball |
26 of 28 | 7d99b0e910 NEW |
none[0] | none:none |
PolyEnE| | lines=68 | trace |
| T:12:00:00 | Win2K-f | 202.147.209.253 (KCN-TV.NE.JP): KUMAMOTO CABLE NETWORK CORPORATION, KUMAMOTO, KUMAMOTO, JP. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 75 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 32 |
53bfe15e91 NEW 73f1082158 NEW |
1473091351 [0] none [0] |
ASM:Graph none:none |
tElock| Armadillo| |
lines=75 embedded dns lines=90 |
trace trace |
| T:12:39:00 | WinXP | 4.184.95.88 (LEVEL3.NET): LEVEL 3 COMMUNICATIONS INC, CARTERET, NEW JERSEY, US. (DIAL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 76 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 33 |
53bfe15e91 NEW a08f3b74a4 NEW |
1473091351 [0] none [0] |
ASM:Graph none:none |
tElock| Armadillo| |
lines=75 embedded dns lines=90 |
trace trace |
| T:13:22:00 | WinXP | 24.209.185.126 (RR.COM): ROAD RUNNER HOLDCO LLC, MILWAUKEE, WISCONSIN, US. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 76 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 33 |
53bfe15e91 NEW a08f3b74a4 NEW |
1473091351 [0] none [0] |
ASM:Graph none:none |
tElock| Armadillo| |
lines=75 embedded dns lines=90 |
trace trace |
| T:13:43:00 | Win2K-f | 4.181.76.131 (LEVEL3.NET): LEVEL 3 COMMUNICATIONS INC, IMPERIAL, MISSOURI, US. (DSL) |
n/a | 135 | pcap | raw alerts ruleset |
other 153 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 32 |
53bfe15e91 NEW 73f1082158 NEW |
1473091351 [0] none [0] |
ASM:Graph none:none |
tElock| Armadillo| |
lines=75 embedded dns lines=90 |
trace trace |
|
| 14:43:00 | Win2K-f | 186.18.202.223 (186.IN-ADDR.ARPA): TELECENTRO S.A. - CLIENTES RESIDENCIALES, BUENOS AIRES, BUENOS AIRES, AR. (DSL) |
n/a | US:www.maxmind.com :checkip.dyndns.org DE:131.220.6.26:80 |
445 | pcap | raw alerts ruleset |
http 5 lines |
Yeah : 0.8 profile |
none | summary tarball |
3 of 37 | d9cb288f31 NEW |
45603a001c [0] | ASM:Graph |
UPX| | lines=174 embedded dns |
trace |
| T:14:51:00 | Win2K-f | 186.18.202.223 (186.IN-ADDR.ARPA): TELECENTRO S.A. - CLIENTES RESIDENCIALES, BUENOS AIRES, BUENOS AIRES, AR. (DSL) |
n/a | US:www.maxmind.com EU:getmyip.co.uk US:www.getmyip.org :checkip.dyndns.org DE:131.220.6.26:80 US:67.15.94.80:80 US:75.126.138.202:80 EU:78.40.35.134:80 |
445 | pcap | raw alerts ruleset |
http 4 lines |
Yeah : 0.8 profile |
none | summary tarball |
3 of 37 | d9cb288f31 NEW |
45603a001c [0] | ASM:Graph |
UPX| | lines=174 embedded dns |
trace |
| T:14:56:00 | WinXP | 69.193.74.22 (RR.COM): ROAD RUNNER HOLDCO LLC, HERNDON, VIRGINIA, US. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 75 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 32 |
53bfe15e91 NEW 73f1082158 NEW |
1473091351 [0] none [0] |
ASM:Graph none:none |
tElock| Armadillo| |
lines=75 embedded dns lines=90 |
trace trace |
| T:15:34:00 | WinXP | 173.22.161.143 (MCHSI.COM): MEDIACOM COMMUNICATIONS CORP, SPRINGFIELD, MISSOURI, US. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 110 lines |
Yeah : 1.3 profile |
none | summary tarball |
38 of 41 39 of 41 |
10759405e0 NEW d08e00dfaf NEW |
292d343248 [0] 854c49d8c4[0] |
none:none none:none |
Armadillo| tElock| |
none none |
trace trace |
| 15:44:00 | Win2K-f | 200.110.183.99 (COM.AR): COOPERATIVA RURAL ELECTRICA DE BRAGADO LTDA, BUENOS AIRES, BUENOS AIRES, AR. (DSL) |
n/a | US:www.maxmind.com :checkip.dyndns.org DE:131.220.6.26:80 |
445 | pcap | raw alerts ruleset |
http 5 lines |
Yeah : 0.8 profile |
none | summary tarball |
3 of 37 | d9cb288f31 NEW |
45603a001c [0] | ASM:Graph |
UPX| | lines=174 embedded dns |
trace |
| 16:23:00 | WinXP | 97.106.174.162 (RR.COM): ROAD RUNNER HOLDCO LLC, LUTZ, FLORIDA, US. (DSL) |
n/a | :moscow-advokat.ru SE:qis.md.us.dal.net :brussels.be.eu.undernet.org SE:viking.dal.net SE:ozbytes.dal.net :london.uk.eu.undernet.org SE:vancouver.dal.net :gaspode.zanet.org.za SE:coins.dal.net :los-angeles.ca.us.undernet.org :lulea.se.eu.undernet.org :caen.fr.eu.undernet.org |
445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 1.3 profile |
none | summary tarball |
25 of 25 | 7f60162c2c NEW |
none[0] | none:none |
PolyEnE| | lines=93 embedded dns |
trace |
| T:16:46:00 | Win2K-f | 211.215.83.187 (HANANET.NET): HANARO TELECOM INC, SEOUL, SEOUL-T'UKPYOLSI, KR. (DSL) |
88.198.228.238:65520 | DE:proxima.ircgalaxy.pl US:microsoft.com :monstersoftware.info CN:down1130.iwillhavesexygirls.com CN:1130.kfgrtjer.cn :bfkq.com :jsactivity.com :wws.mobiec.net CN:russia.2288.org US:search.toptravellingtips.com 173.45.105.218:8392 CN:210.51.36.215:88 US:66.96.221.101:8392 |
135 | pcap | raw alerts ruleset |
irc http 191 lines |
Yeah : 1.8 profile |
none | summary tarball |
0 of 33 6 of 40 2 of 40 13 of 41 39 of 41 26 of 41 8 of 41 20 of 41 0 of 40 |
4c3df24b32 NEW 828664c208 NEW 847f741e7a NEW a836ced040 NEW aa84072c02 NEW dd96e88e03 NEW e68043c227 NEW f1ac647184 NEW f56a2282ae NEW |
none[0] none [none] none [none] none [none] none [none] 6f87541765[0] none [none] none [none] none [none] |
ASM:Graph none:none none:none none:none none:none none:none none:none none:none none:none |
Armadillo| none|none none|none none|none none|none StarForce| none|none none|none none|none |
lines=81 none none none none none none none none |
trace none none none none trace none none none |
| T:17:01:00 | Win2K-f | 156.25.1.53 (-): ADMINISTRATION CANTONALE DE FRIBOURG, FRIBOURG, FRIBOURG, CH. (DSL) |
n/a | :search.financejungle.co.uk :www.financejungle.co.uk :seekbbs.com :seekadvance.com US:search.thefreewebsitedirectory.co.uk EU:www.thefreewebsitedirectory.co.uk EU:77.68.59.22:80 |
445 | pcap | raw alerts ruleset |
http irc lanman 176 lines |
Argh : 0.3 profile |
none | summary tarball |
12 of 41 | 57c9c443d2 NEW |
none[none] | none:none |
none|none | none | none |
| T:17:12:00 | Win2K-f | 69.106.179.171 (PACBELL.NET): AT&T INTERNET SERVICES, FRESNO, CALIFORNIA, US. (DSL) |
193.104.94.11:65520 | :parkingbill.com DE:proxima.ircgalaxy.pl CN:down1130.iwillhavesexygirls.com CN:1130.kfgrtjer.cn :wws.mobiec.net :xz.ub9.net CN:russia.2288.org :in.7cy.net :in1.7cy.net :appphone.info :www.google-analytics.com CA:furniture-sets.net US:66.96.221.101:8392 CA:74.117.114.65:80 |
445 | pcap | raw alerts ruleset |
irc http 67 lines |
Yeah : 1.3 profile |
none | summary tarball |
13 of 41 26 of 41 20 of 41 |
a836ced040 NEW dd96e88e03 NEW f1ac647184 NEW |
none[none] 6f87541765[0] none [none] |
none:none none:none none:none |
none|none StarForce| none|none |
none none none |
none trace none |
| T:17:14:00 | WinXP | 64.203.49.124 (MINDSPRING.COM): EARTHLINK INC, SAN DIEGO, CALIFORNIA, US. (DSL) |
n/a | DE:siliconfireware.ru US:searchportal.information.com US:spi.domainsponsor.com :wpad GB:welcome3.smile.co.uk GB:195.92.84.198:80 |
445 | pcap | raw alerts ruleset |
http http http 27 lines |
Yeah : 0.8 profile |
none | summary tarball |
0 of 41 0 of 41 0 of 40 29 of 29 |
0c8664e61b NEW 0f9fd715ea NEW 454b388231 NEW df17a625ee NEW |
none[none] none [none] none [none] none [0] |
none:none none:none none:none none:none |
none|none none|none none|none ASPack| |
none none none lines=298 embedded dns |
none none none trace |
| T:17:26:00 | WinXP | 113.254.115.38 (HUTCHCITY.COM): HUTCHISON GLOBAL COMMUNICATIONS, HONG KONG, HONG KONG (SAR), HK. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 100 lines |
Yeah : 1.3 profile |
none | summary tarball |
37 of 41 37 of 41 |
568b9e866c NEW 5c20c3472e NEW |
none[none] none [none] |
none:none none:none |
none|none none|none |
none none |
none none |
| T:19:02:00 | WinXP | 114.48.147.197 (E-MOBILE.NE.JP): EMOBILE LTD, TOKYO, TOKYO, JP. (DSL) |
n/a | RU:citi-bank.ru | 445 | pcap | raw alerts ruleset |
http 1 line |
Yeah : 0.8 profile |
none | summary tarball |
39 of 40 | 5e8ccc4190 NEW |
8d5f86583f [0] | none:none |
PolyEnE| | none | trace |
| 19:07:00 | Win2K-f | 218.172.100.244 (HINET.NET): CHUNGHWA TELECOM DATA COMMUNICATION BUSINESS GROUP, TAIPEI, T'AI-PEI, TW. (DSL) |
n/a | US:www.maxmind.com US:www.getmyip.org EU:getmyip.co.uk :checkip.dyndns.org DE:131.220.6.26:80 208.78.70.70:80 US:75.126.138.202:80 EU:78.40.35.134:80 |
445 | pcap | raw alerts ruleset |
http 4 lines |
Yeah : 0.8 profile |
none | summary tarball |
3 of 37 | d9cb288f31 NEW |
45603a001c [0] | ASM:Graph |
UPX| | lines=174 embedded dns |
trace |
| T:19:33:00 | Win2K-f | 125.4.248.65 (ZAQ.NE.JP): J:COM WEST CO. LTD, TOKYO, TOKYO, JP. (DSL) |
n/a | 135 | pcap | raw alerts ruleset |
other 1010 lines |
Yeah : 1.3 profile |
none | summary tarball |
39 of 41 14 of 40 |
15953b80a1 NEW def7923243 NEW |
none[none] none [none] |
none:none none:none |
none|none none|none |
none none |
none none |
|
| T:19:57:00 | Win2K-f | 72.229.154.23 (RR.COM): ROAD RUNNER HOLDCO LLC, FLUSHING, NEW YORK, US. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 59 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 8 of 33 |
53bfe15e91 NEW b7082104e4 NEW |
1473091351 [0] c5b49e7b82[0] |
ASM:Graph ASM:Graph |
tElock| tElock| |
lines=75 embedded dns lines=41 |
trace trace |
| T:20:15:00 | Win2K-f | 24.74.26.28 (RR.COM): ROAD RUNNER HOLDCO LLC, ALBEMARLE, NORTH CAROLINA, US. (DSL) |
n/a | US:microsoft.com DE:proxim.ircgalaxy.pl CN:down1130.iwillhavesexygirls.com CN:1130.kfgrtjer.cn :bfkq.com :jsactivity.com :wws.mobiec.net US:search.toptravellingtips.com US:66.96.221.101:8392 |
135 | pcap | raw alerts ruleset |
irc http 433 lines |
Yeah : 1.3 profile |
none | summary tarball |
40 of 41 7 of 39 39 of 40 0 of 41 13 of 41 8 of 41 20 of 41 |
3e04c65ec3 NEW 4b7cd8e5ae NEW 5cdd8b7cca NEW 9d48520478 NEW a836ced040 NEW e68043c227 NEW f1ac647184 NEW |
none[none] none [none] none [none] none [none] none [none] none [none] none [none] |
none:none none:none none:none none:none none:none none:none none:none |
none|none none|none none|none none|none none|none none|none none|none |
none none none none none none none |
none none none none none none none |
| 20:22:00 | Win2K-f | 119.77.142.252 (UBBN.NET): UNION BROADBAND NETWORK, TAIPEI, T'AI-PEI, TW. (DSL) |
n/a | US:www.maxmind.com :checkip.dyndns.org EU:getmyip.co.uk US:www.getmyip.org DE:131.220.6.26:80 208.78.70.70:80 US:75.126.138.202:80 EU:78.40.35.134:80 |
445 | pcap | raw alerts ruleset |
http 4 lines |
Yeah : 0.8 profile |
none | summary tarball |
3 of 37 | d9cb288f31 NEW |
45603a001c [0] | ASM:Graph |
UPX| | lines=174 embedded dns |
trace |
| T:20:34:00 | Win2K-f | 186.9.184.89 (IMOVIL.ENTELPCS.CL): ENTEL PCS TELECOMUNICACIONES S.A, SANTIAGO, REGION METROPOLITANA, CL. (DSL) |
n/a | :searchchocolates.com DE:proxim.ircgalaxy.pl CN:down1130.iwillhavesexygirls.com CN:1130.kfgrtjer.cn :wws.mobiec.net CN:russia.2288.org 98.126.9.218:80 |
445 | pcap | raw alerts ruleset |
http irc 51 lines |
Yeah : 0.8 profile |
none | summary tarball |
13 of 41 20 of 41 |
a836ced040 NEW f1ac647184 NEW |
none[none] none [none] |
none:none none:none |
none|none none|none |
none none |
none none |
| T:20:55:00 | WinXP | 24.80.178.139 (SHAWCABLE.NET): SHAW COMMUNICATIONS INC, VANCOUVER, BRITISH COLUMBIA, CA. (DSL) |
n/a | 135 | pcap | raw alerts ruleset |
other 18 lines |
Yeah : 1.3 profile |
none | summary tarball |
none | none | none | none | none | none | none | |
| 21:52:00 | WinXP | 208.103.158.175 (CORETEL.NET): CORETEL AMERICA INC, MYERSTOWN, PENNSYLVANIA, US. (DIAL) |
213.219.245.212:80 | RU:citi-bank.ru | 445 | pcap | raw alerts ruleset |
http 2 lines |
Yeah : 1.3 profile |
none | summary tarball |
39 of 41 | 912a073945 NEW |
7874c7f21e [0] | none:none |
PolyEnE| | none | trace |
| T:22:09:00 | Win2K-f | 173.168.192.144 (RR.COM): ROAD RUNNER HOLDCO LLC, LUTZ, FLORIDA, US. (DSL) |
n/a | US:microsoft.com | 135 | pcap | raw alerts ruleset |
other 75 lines |
Yeah : 1.3 profile |
none | summary tarball |
33 of 33 0 of 33 |
53bfe15e91 NEW a08f3b74a4 NEW |
1473091351 [0] none [0] |
ASM:Graph none:none |
tElock| Armadillo| |
lines=75 embedded dns lines=90 |
trace trace |