Using Memory Management to Detect and Extract Illegitimate Code ...

[21.9.2012 12:11:24] [ 24] to 0x77c15ed5 msvcrt._pi_by_2_to_61+0x12db[21.9.2012 12:11:24] [ 23] from 0x80541fc7 ntkrnlpa.Kei386EoiHelper+0xab[21.9.2012 12:11:24] [ 23] to 0x77c15ed5 msvcrt._pi_by_2_to_61+0x12db[21.9.2012 12:11:24] [ 22] from 0x77c15ed6 msvcrt._pi_by_2_to_61+0x12dc[21.9.2012 12:11:24] ROP-RET ####################[21.9.2012 12:11:24] [ 22] to 0x77c29e29 msvcrt._aligned_offset_malloc+0x7a[21.9.2012 12:11:24] [ 21] from 0x77c29e2d msvc