A malware analyst receives a suspicious Windows executable flagged by an endpoint agent. Before detonating the sample, the analyst wants to gather quick, low-risk intelligence such as embedded URLs, potential registry keys, and hardcoded IP addresses without executing the file. Which technique should the analyst use at this stage of the malware analysis process?