AWayOut[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

AWayOut.exe
Size

233.2MB
MD5

de726d684c587a8b5849537427a5f430
SHA1

7a5c7522b3e97e9ed3c6c7e59f6d950ec08e1c69
SHA256

cece3d370f99abedb96ecba18d05e4a137c36db0e41fdeef1d5410476897ef60
SHA512

6d8db3ee2212b9174517fa6259d7f369b2abd545d5297be22bb330c5f9ddc68053e9144849816930abb3a78a9c4dd4d7792ecf73601f0c51421a9d144897d2f8
SSDEEP

3145728:JGB6LGUihHbNYlSX0VN8HdZ9NDoUmW73WvGLvAzZyo:Lg4rV29JGW7mGLYEo

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
AWayOut.exe

Files

AWayOut.exe
.exe windows:6 windows x64 arch:x64

89006c0835da320be910f420551891b8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

CryptAcquireContextA
CryptGenRandom
CryptReleaseContext
GetUserNameW
RegCloseKey
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyExW
RegEnumValueW
RegOpenKeyExW
RegSetValueExW

api-ms-win-crt-convert-l1-1-0

_itoa_s
_strtoui64
_wcstoui64
_wtof
_wtoi
_wtoi64
atof
atoi
strtod
strtoul
wcstod
wcstoul

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-filesystem-l1-1-0

_wsplitpath_s

api-ms-win-crt-heap-l1-1-0

_aligned_malloc
calloc
free
malloc
realloc
_aligned_free

api-ms-win-crt-math-l1-1-0

_finite
_fpclass
_isnan
ceil
floor
frexp
ldexp
log2f
modf
roundf

api-ms-win-crt-runtime-l1-1-0

_beginthread
_beginthreadex
_errno
_invalid_parameter_noinfo_noreturn
_set_invalid_parameter_handler
strerror
__sys_nerr

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func
__stdio_common_vfprintf
__stdio_common_vfwprintf
__stdio_common_vsprintf
__stdio_common_vsprintf_s
__stdio_common_vsscanf
__stdio_common_vswprintf
__stdio_common_vswprintf_s
_read
_write
fclose
fgets
fopen
fopen_s
fputc
fread
fseek
ftell
fwrite

api-ms-win-crt-string-l1-1-0

_strdup
_stricmp
_strnicmp
_wcsnicmp
isdigit
isspace
isupper
iswalnum
iswalpha
iswdigit
iswspace
isxdigit
strcpy_s
strncpy
tolower
toupper
towlower
towupper
wcslen
wcsncmp
wcsncpy

api-ms-win-crt-time-l1-1-0

__timezone
__tzname
_ftime64_s
_gmtime64
_localtime64
_mktime64
_time64
_tzset
strftime

api-ms-win-crt-utility-l1-1-0

qsort
rand
srand
bsearch

dbghelp

StackWalk64
SymFunctionTableAccess64
SymGetLineFromAddr64
SymGetModuleBase64
SymGetModuleInfo64
SymGetSymFromAddr64

dwmapi

DwmFlush
DwmGetCompositionTimingInfo
DwmIsCompositionEnabled

gdi32

CreateFontIndirectW
DeleteObject
GetObjectW
GetStockObject
PtInRegion
SwapBuffers
CreateBitmap

kernel32

AcquireSRWLockExclusive
AcquireSRWLockShared
AttachConsole
CloseHandle
CreateDirectoryW
CreateEventW
CreateFileMappingW
CreateFileW
CreateMutexA
CreateMutexW
CreateProcessW
CreateSemaphoreA
CreateSemaphoreW
CreateThread
DeleteCriticalSection
DeleteFileW
EnterCriticalSection
ExitProcess
FileTimeToSystemTime
FindClose
FindFirstFileW
FindNextFileW
FindResourceW
FormatMessageA
FormatMessageW
FreeConsole
FreeLibrary
GetCommandLineW
GetComputerNameW
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetEnvironmentVariableA
GetEnvironmentVariableW
GetExitCodeThread
GetFileAttributesExW
GetFileAttributesW
GetFileSizeEx
GetLastError
GetLocalTime
GetModuleFileNameW
GetModuleHandleW
GetNativeSystemInfo
GetOverlappedResult
GetProcAddress
GetProcessHeap
GetProcessTimes
GetSystemDirectoryW
GetSystemInfo
GetSystemTime
GetSystemTimeAsFileTime
GetThreadContext
GetTickCount
GetTickCount64
GetTimeZoneInformation
GetUserDefaultLocaleName
GetVersionExW
GlobalAlloc
GlobalLock
GlobalMemoryStatus
GlobalMemoryStatusEx
GlobalUnlock
HeapAlloc
HeapFree
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
InitializeSRWLock
LeaveCriticalSection
LoadLibraryA
LoadLibraryExW
LoadLibraryW
LoadResource
LocalAlloc
LocalFree
LockResource
MapViewOfFile
MoveFileW
MultiByteToWideChar
OpenThread
OutputDebugStringA
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReadFile
ReleaseMutex
ReleaseSRWLockExclusive
ReleaseSRWLockShared
ReleaseSemaphore
RemoveDirectoryW
ResetEvent
ResumeThread
RtlVirtualUnwind
SetConsoleTextAttribute
SetCriticalSectionSpinCount
SetEvent
SetFileAttributesW
SetLastError
SetThreadAffinityMask
SetThreadIdealProcessor
SetThreadPriority
SetThreadPriorityBoost
SizeofResource
Sleep
SleepEx
SuspendThread
SwitchToThread
SystemTimeToFileTime
TerminateProcess
TerminateThread
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
TryEnterCriticalSection
UnmapViewOfFile
VerSetConditionMask
VerifyVersionInfoA
VerifyVersionInfoW
VirtualProtect
WaitForSingleObject
WaitForSingleObjectEx
WideCharToMultiByte
WriteFile
lstrlenA

msvcp140

??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??_7?$basic_ios@DU?$char_traits@D@std@@@std@@6B@
??_7?$basic_ostream@DU?$char_traits@D@std@@@std@@6B@
??_7ios_base@std@@6B@
?_Ios_base_dtor@ios_base@std@@CAXPEAV12@@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?seekp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@V?$fpos@U_Mbstatet@@@2@@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?tellp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
_Inf

normaliz

IdnToAscii

ole32

CoCreateInstance
CoInitialize
CoTaskMemFree
CoUninitialize
IIDFromString
OleInitialize
OleUninitialize

oleaut32

VariantCopy

opengl32

wglCreateContext
wglDeleteContext
wglGetCurrentContext
wglGetCurrentDC
wglGetProcAddress
wglMakeCurrent

shell32

SHGetFolderPathW
ShellExecuteW
CommandLineToArgvW

user32

AdjustWindowRectEx
ChangeDisplaySettingsExW
ChangeDisplaySettingsW
CloseClipboard
CreateIconIndirect
CreateWindowExW
DestroyWindow
DisableProcessWindowsGhosting
DispatchMessageW
EmptyClipboard
EnumDisplayDevicesA
EnumDisplaySettingsW
GetActiveWindow
GetAsyncKeyState
GetClientRect
GetCursorPos
GetDC
GetFocus
GetForegroundWindow
GetKeyState
GetKeyboardLayout
GetMonitorInfoW
GetParent
GetSystemMetrics
GetWindowInfo
GetWindowLongW
GetWindowPlacement
GetWindowRect
GetWindowThreadProcessId
IsChild
IsIconic
IsWindowEnabled
IsZoomed
LoadCursorW
LoadIconW
LoadImageW
MapVirtualKeyW
MessageBoxW
MonitorFromRect
MonitorFromWindow
OpenClipboard
PeekMessageW
PostMessageW
PostQuitMessage
RegisterClassW
RegisterRawInputDevices
ReleaseDC
SendInput
SetClipboardData
SetFocus
SetLayeredWindowAttributes
SetParent
SetWindowPos
SetWindowRgn
SetWindowTextW
ShowCursor
ShowWindow
SystemParametersInfoW
TranslateMessage
UnregisterClassW
UpdateWindow
WindowFromPoint

vcruntime140

__std_exception_copy
__std_exception_destroy
__std_type_info_compare
__std_type_info_name
_set_purecall_handler
memmove
strchr
strrchr
strstr
wcschr
wcsstr

wininet

HttpQueryInfoW
InternetAttemptConnect
InternetCloseHandle
InternetGetConnectedState
InternetOpenW
InternetReadFile
InternetSetOptionW
InternetSetStatusCallbackW

winmm

timeGetDevCaps
timeGetTime
waveInMessage
waveOutMessage
timeBeginPeriod

ws2_32

accept
ioctlsocket
WSAGetLastError
WSAStartup
WSACleanup
listen
ntohl
ntohs
recv
recvfrom
select
send
bind
sendto
setsockopt
shutdown
socket
closesocket
connect
getpeername
gethostname
getsockname
getsockopt
htonl
htons
freeaddrinfo
getaddrinfo
inet_pton

x3daudio1_7

X3DAudioInitialize

Exports

Exports

AmdPowerXpressRequestHighPerformance
GetDenuvoTicketLocation
GetDenuvoTimeTicketRequest
NvOptimusEnablement
OriginAcceptFriendInvite
OriginAcceptFriendInviteSync
OriginAcceptInvite
OriginAcceptInviteSync
OriginAddEvent
OriginAddEventParameter
OriginAddRecentPlayers
OriginAddRecentPlayersSync
OriginAreChunksInstalled
OriginAreChunksInstalledSync
OriginBlockUser
OriginBlockUserSync
OriginBroadcastCheckStatus
OriginBroadcastStart
OriginBroadcastStop
OriginCheckOnline
OriginCheckPermission
OriginCheckout
OriginCheckoutSync
OriginConsumeEntitlement
OriginConsumeEntitlementSync
OriginCreateChunk
OriginCreateChunkSync
OriginCreateEventRecord
OriginCreateGroup
OriginCreateGroupSync
OriginDestroyHandle
OriginEnableDebug
OriginEnableVoip
OriginEnableVoipSync
OriginEnterGroup
OriginEnterGroupSync
OriginGetAllGameInfo
OriginGetAllGameInfoSync
OriginGetCatalog
OriginGetCatalogSync
OriginGetChunkPriority
OriginGetChunkPrioritySync
OriginGetDefaultPersona
OriginGetDefaultUser
OriginGetEnumerateStatus
OriginGetErrorDescription
OriginGetErrorInfo
OriginGetGameInfo
OriginGetGameInfoSync
OriginGetGroupInfo
OriginGetGroupInfoSync
OriginGetPresence
OriginGetPresenceVisibility
OriginGetProfile
OriginGetProfileSync
OriginGetSetting
OriginGetSettingSync
OriginGetSettings
OriginGetSettingsSync
OriginGetStore
OriginGetStoreSync
OriginGetUTCTime
OriginGetVoipStatus
OriginGetVoipStatusSync
OriginGetWalletBalance
OriginGetWalletBalanceSync
OriginGoOnline
OriginGrantAchievement
OriginGrantAchievementSync
OriginHookDebug
OriginInviteUsersToGroup
OriginInviteUsersToGroupSync
OriginIsFileDownloaded
OriginIsFileDownloadedSync
OriginIsProgressiveInstallationAvailable
OriginIsProgressiveInstallationAvailableSync
OriginLeaveGroup
OriginLeaveGroupSync
OriginMuteUser
OriginMuteUserSync
OriginPostAchievementEvents
OriginPostAchievementEventsSync
OriginPostWincodes
OriginPostWincodesSync
OriginQueryAchievements
OriginQueryAchievementsSync
OriginQueryAreFriends
OriginQueryAreFriendsSync
OriginQueryBlockedUsers
OriginQueryBlockedUsersSync
OriginQueryCategories
OriginQueryCategoriesSync
OriginQueryChunkFiles
OriginQueryChunkFilesSync
OriginQueryChunkStatus
OriginQueryChunkStatusSync
OriginQueryContent
OriginQueryContentSync
OriginQueryEntitlements
OriginQueryEntitlementsEX
OriginQueryEntitlementsSync
OriginQueryEntitlementsSyncEX
OriginQueryFriends
OriginQueryFriendsSync
OriginQueryGroup
OriginQueryGroupSync
OriginQueryImage
OriginQueryImageSync
OriginQueryManifest
OriginQueryManifestSync
OriginQueryMuteState
OriginQueryMuteStateSync
OriginQueryOffers
OriginQueryOffersEX
OriginQueryOffersSync
OriginQueryOffersSyncEX
OriginQueryPresence
OriginQueryPresenceSync
OriginQueryUserId
OriginQueryUserIdSync
OriginReadEnumeration
OriginReadEnumerationSync
OriginRegisterErrorCallback
OriginRegisterEventCallback
OriginRemoveFriend
OriginRemoveFriendSync
OriginRemoveUsersFromGroup
OriginRemoveUsersFromGroupSync
OriginRequestAuthCode
OriginRequestAuthCodeSync
OriginRequestFriend
OriginRequestFriendSync
OriginRequestFriendUI
OriginRequestFriendUISync
OriginRequestTicket
OriginRequestTicketSync
OriginResetMemory
OriginRestartGame
OriginRestartGameSync
OriginSelectInstance
OriginSelectStore
OriginSelectStoreEX
OriginSendChatMessage
OriginSendGameMessage
OriginSendGroupGameInvite
OriginSendGroupGameInviteSync
OriginSendInvite
OriginSendInviteSync
OriginSetChunkPriority
OriginSetChunkPrioritySync
OriginSetDownloadUtilization
OriginSetDownloadUtilizationSync
OriginSetPresence
OriginSetPresenceVisibility
OriginSetupMemory
OriginShowAchievementUI
OriginShowAchievementUISync
OriginShowBroadcastUI
OriginShowBroadcastUISync
OriginShowBrowserUI
OriginShowBrowserUISync
OriginShowChangeAvatarUI
OriginShowChangeAvatarUISync
OriginShowCheckoutUI
OriginShowCheckoutUISync
OriginShowCodeRedemptionUI
OriginShowCodeRedemptionUISync
OriginShowComposeChatUI
OriginShowComposeChatUISync
OriginShowFeedbackUI
OriginShowFeedbackUISync
OriginShowFindFriendsUI
OriginShowFindFriendsUISync
OriginShowFriendsProfileUI
OriginShowFriendsProfileUISync
OriginShowFriendsUI
OriginShowFriendsUISync
OriginShowGameDetailsUI
OriginShowGameDetailsUISync
OriginShowIGO
OriginShowIGOSync
OriginShowInviteUI
OriginShowInviteUISync
OriginShowLoginUI
OriginShowLoginUISync
OriginShowProfileUI
OriginShowProfileUISync
OriginShowRecentUI
OriginShowRecentUISync
OriginShowStoreUI
OriginShowStoreUIEX
OriginShowStoreUIEXSync
OriginShowStoreUISync
OriginShutdown
OriginStartDownload
OriginStartDownloadSync
OriginStartGame
OriginStartGameSync
OriginStartup
OriginSubscribePresence
OriginUnblockUser
OriginUnblockUserSync
OriginUnregisterEventCallback
OriginUnsubscribePresence
OriginUpdate
agsDeInit
agsDriverExtensionsDX11_BeginUAVOverlap
agsDriverExtensionsDX11_DeInit
agsDriverExtensionsDX11_EndUAVOverlap
agsDriverExtensionsDX11_GetMaxClipRects
agsDriverExtensionsDX11_IASetPrimitiveTopology
agsDriverExtensionsDX11_Init
agsDriverExtensionsDX11_MultiDrawIndexedInstancedIndirect
agsDriverExtensionsDX11_MultiDrawIndexedInstancedIndirectCountIndirect
agsDriverExtensionsDX11_MultiDrawInstancedIndirect
agsDriverExtensionsDX11_MultiDrawInstancedIndirectCountIndirect
agsDriverExtensionsDX11_NumPendingAsyncCompileJobs
agsDriverExtensionsDX11_SetClipRects
agsDriverExtensionsDX11_SetDepthBounds
agsDriverExtensionsDX11_SetDiskShaderCacheEnabled
agsDriverExtensionsDX11_SetMaxAsyncCompileThreadCount
agsDriverExtensionsDX11_SetViewBroadcastMasks
agsGetCrossfireGPUCount
agsInit
agsSetDisplayMode
opus_decode
opus_decode_float
opus_decoder_create
opus_decoder_ctl
opus_decoder_destroy
opus_decoder_get_nb_samples
opus_decoder_get_size
opus_decoder_init
opus_encode
opus_encode_float
opus_encoder_create
opus_encoder_ctl
opus_encoder_destroy
opus_encoder_get_size
opus_encoder_init
opus_get_version_string
opus_multistream_decode
opus_multistream_decode_float
opus_multistream_decoder_create
opus_multistream_decoder_ctl
opus_multistream_decoder_destroy
opus_multistream_decoder_get_size
opus_multistream_decoder_init
opus_multistream_packet_pad
opus_multistream_packet_unpad
opus_packet_get_bandwidth
opus_packet_get_nb_channels
opus_packet_get_nb_frames
opus_packet_get_nb_samples
opus_packet_get_samples_per_frame
opus_packet_pad
opus_packet_parse
opus_packet_unpad
opus_pcm_soft_clip
opus_repacketizer_cat
opus_repacketizer_create
opus_repacketizer_destroy
opus_repacketizer_get_nb_frames
opus_repacketizer_get_size
opus_repacketizer_init
opus_repacketizer_out
opus_repacketizer_out_range
opus_strerror

Sections

.tls
Size: 49.5MB - Virtual size: 49.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.code
Size: 15.8MB - Virtual size: 15.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 547KB - Virtual size: 4.0MB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.sbss
Size: 512B - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.trace
Size: 512B - Virtual size: 4KB

IMAGE_SCN_MEM_READ

.sdata
Size: 32KB - Virtual size: 36KB

IMAGE_SCN_MEM_READ

.xdata
Size: 164.7MB - Virtual size: 164.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.srdata
Size: 37KB - Virtual size: 40KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.xtls
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data1
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 24KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 332KB - Virtual size: 332KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

89006c0835da320be910f420551891b8

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

dbghelp

dwmapi

gdi32

kernel32

msvcp140

normaliz

ole32

oleaut32

opengl32

shell32

user32

vcruntime140

wininet

winmm

ws2_32

x3daudio1_7

Exports

Exports

Sections

.tls Size: 49.5MB - Virtual size: 49.5MB

.code Size: 15.8MB - Virtual size: 15.8MB

.reloc Size: 547KB - Virtual size: 4.0MB

.pdata Size: 2.2MB - Virtual size: 2.2MB

.sbss Size: 512B - Virtual size: 4KB

.trace Size: 512B - Virtual size: 4KB

.sdata Size: 32KB - Virtual size: 36KB

.xdata Size: 164.7MB - Virtual size: 164.7MB

.srdata Size: 37KB - Virtual size: 40KB

.xtls Size: 3KB - Virtual size: 4KB

.data1 Size: 512B - Virtual size: 4KB

.edata Size: 24KB - Virtual size: 28KB

.data Size: 332KB - Virtual size: 332KB

.tls
Size: 49.5MB - Virtual size: 49.5MB

.code
Size: 15.8MB - Virtual size: 15.8MB

.reloc
Size: 547KB - Virtual size: 4.0MB

.pdata
Size: 2.2MB - Virtual size: 2.2MB

.sbss
Size: 512B - Virtual size: 4KB

.trace
Size: 512B - Virtual size: 4KB

.sdata
Size: 32KB - Virtual size: 36KB

.xdata
Size: 164.7MB - Virtual size: 164.7MB

.srdata
Size: 37KB - Virtual size: 40KB

.xtls
Size: 3KB - Virtual size: 4KB

.data1
Size: 512B - Virtual size: 4KB

.edata
Size: 24KB - Virtual size: 28KB

.data
Size: 332KB - Virtual size: 332KB