Category Archives: Malware Analysis

Shellcode. I’ll Call you back.

Posted on by

Many malicious wrappers and position-independent payloads (especially based on AutoIT, and VB) attempt to use various techniques to execute the main payload evading the curious eyes of security solutions, and malware analysts. One of the most popular ways to execute the code in a more stealthy way relies on using a mechanism known as a ‘call back’. A typical call back is just a function address that is passed to a legitimate, most often a well-documented and innocent API function and then the call back function is executed internally when the API encounters a specific event the call back is set up to intercept.

Some call backs are set up asynchronously and will be called in response to specific events f.ex. windows hooks execute a call back function when a key is pressed on the keyboard, a mouse moved, or a window maximized, and timer callbacks are called after a specific time interval passes. Others are executed synchronously by a given API that relies on the call back mechanism to allow the callback function to intercept some data while enumerating certain properties of the system (f.ex. popular lately EnumDateFormats). The latter are the most commonly call back functions used by the wrappers.

Since this trick is popular and kinda stealthy + makes things a bit harder to analyze… every once in a while a ‘new’ type of malware pops up using a previously unknown, or barely known call back function which – in return – obviously triggers an interest of the malware analysts all over the place.

It crossed my mind that it would be cool to list all possible (or, more precisely: all documented) call back functions giving us at least a theoretical knowledge of what is out there. And this is what this post is about. While the list doesn’t cover everything, it certainly covers a lot – it includes 500+ call back functions documented in MSDN and on Microsoft web site, or elsewhere. Hopefully, a good start to include these in sandboxing solutions and API monitors of any sort.

As usual, if you spot any mistake in the list, please let me know and I’ll fix it. Thanks!

Here’s the list:

  • acmDriverEnumCallback
  • acmDriverProc
  • acmFilterChooseHookProc
  • acmFilterEnumCallback
  • acmFilterTagEnumCallback
  • acmFormatChooseHookProc
  • acmFormatEnumCallback
  • acmFormatTagEnumCallback
  • acmStreamConvertCallback
  • AddInterface
  • AddPropSheetPageProc
  • AddSecureMemoryCacheCallback
  • agePaintHook
  • ageSetupHook
  • AllocateMemory
  • APCProc
  • ApplicationRecoveryCallback
  • ApplyCallbackFunction
  • asswordChangeNotify
  • asswordFilter
  • AuthzAccessCheckCallback
  • AuthzComputeGroupsCallback
  • AuthzFreeGroupsCallback
  • BindIoCompletionCallback
  • BlockConvertServicesToStatic
  • BlockDeleteStaticServices
  • BrowseCallbackProc
  • BufferCallback
  • CallWndProc
  • CallWndRetProc
  • capControlCallback
  • capErrorCallback
  • capStatusCallback
  • capVideoStreamCallback
  • capWaveStreamCallback
  • capYieldCallback
  • CBTProc
  • CCHookProc
  • CertChainFindByIssuerCallback
  • CertDllOpenStoreProv
  • CertEnumPhysicalStoreCallback
  • CertEnumSystemStoreCallback
  • CertEnumSystemStoreLocationCallback
  • CertStoreProvCloseCallback
  • CertStoreProvDeleteCertCallback
  • CertStoreProvDeleteCRLCallback
  • CertStoreProvDeleteCTL
  • CertStoreProvFindCert
  • CertStoreProvFindCRL
  • CertStoreProvFindCTL
  • CertStoreProvFreeFindCert
  • CertStoreProvFreeFindCRL
  • CertStoreProvFreeFindCTL
  • CertStoreProvGetCertProperty
  • CertStoreProvGetCRLProperty
  • CertStoreProvGetCTLProperty
  • CertStoreProvReadCertCallback
  • CertStoreProvReadCRLCallback
  • CertStoreProvReadCTL
  • CertStoreProvSetCertPropertyCallback
  • CertStoreProvSetCRLPropertyCallback
  • CertStoreProvSetCTLProperty
  • CertStoreProvWriteCertCallback
  • CertStoreProvWriteCRLCallback
  • CertStoreProvWriteCTL
  • CFHookProc
  • ClaimMediaLabel
  • CleanupGroupCancelCallback
  • ClientCallback
  • ClientCallback_Function
  • CloseServiceEnumerationHandle
  • CollectPerformanceData
  • CompletionProc
  • ConnectClient
  • ControlCallback
  • CopyProgressRoutine
  • CounterPathCallBack
  • CQPageProc
  • CreateServiceEnumerationHandle
  • CreateStaticService
  • CryptGetSignerCertificateCallback
  • CRYPT_ENUM_KEYID_PROP
  • CRYPT_ENUM_OID_FUNCTION
  • CRYPT_ENUM_OID_INFO
  • CRYPT_RETURN_HWND
  • CRYPT_VERIFY_IMAGE
  • CspGetDHAgreement
  • DavAuthCallback
  • DavFreeCredCallback
  • DavRegisterAuthCallback
  • DavUnregisterAuthCallback
  • DdeCallback
  • DdeEnableCallback
  • DeleteInterface
  • DeleteStaticService
  • DemandDialRequest
  • DhcpAddressDelHook
  • DhcpAddressOfferHook
  • DhcpControlHook
  • DhcpDeleteClientHook
  • DhcpHandleOptionsHook
  • DhcpNewPktHook
  • DhcpPktDropHook
  • DhcpPktSendHook
  • DhcpServerCalloutEntry
  • DialogProc
  • DigestFunction
  • DisassociateCurrentThreadFromCallback
  • DisconnectClient
  • DllCallbackProc
  • DllGetClassObject
  • DoUpdateRoutes
  • DoUpdateServices
  • DPA_DestroyCallback
  • DPA_EnumCallback
  • DrawStateProc
  • DriverCallback
  • DSA_DestroyCallback
  • DSA_EnumCallback
  • DSEnumAttributesCallback
  • EditStreamCallback
  • EditWordBreakProc
  • EditWordBreakProcEx
  • EmbeddedUIHandler
  • EnableCallback
  • EnhMetaFileProc
  • EnumCalendarInfoProc
  • EnumCalendarInfoProcEx
  • EnumCalendarInfoProcExEx
  • EnumChildProc
  • EnumCodePagesProc
  • EnumDateFormatsProc
  • EnumDateFormatsProcEx
  • EnumDateFormatsProcExEx
  • EnumDesktopProc
  • EnumDirTreeProc
  • EnumerateGetNextService
  • EnumerateLoadedModulesProc64
  • EnumFontFamExProc
  • EnumFontFamProc
  • EnumFontsProc
  • EnumGeoInfoProc
  • EnumICMProfilesProcCallback
  • EnumInputContext
  • EnumLanguageGroupLocalesProc
  • EnumLanguageGroupsProc
  • EnumLocalesProc
  • EnumLocalesProcEx
  • EnumMetaFileProc
  • EnumObjectsProc
  • EnumPageFilesProc
  • EnumRegisterWordProc
  • EnumResLangProc
  • EnumResNameProc
  • EnumResTypeProc
  • EnumThreadWndProc
  • EnumTimeFormatsProc
  • EnumTimeFormatsProcEx
  • EnumUILanguagesProc
  • EnumWindowsProc
  • EnumWindowStationProc
  • EventCallback
  • EventClassCallback
  • EventRecordCallback
  • Event_Handler_Function_Name
  • EVT_SUBSCRIBE_CALLBACK
  • ExportCallback
  • FaxLineCallback
  • FaxRouteAddFile
  • FaxRouteDeleteFile
  • FaxRouteEnumFile
  • FaxRouteEnumFiles
  • FaxRouteGetFile
  • FaxRouteModifyRoutingData
  • FaxRoutingInstallationCallback
  • FaxSendCallback
  • FAX_RECIPIENT_CALLBACK
  • FExecuteInAppDomainCallback
  • FiberProc
  • FileIOCompletionRoutine
  • FILE_RESTORE_CALLBACK
  • FindDebugInfoFileProc
  • FindExecutableImageProc
  • FLockClrVersionCallback
  • FlsCallback
  • FNCCERTDISPLAYPROC
  • FNCFILTERPROC
  • FNCMFILTERPROC
  • FNCMHOOKPROC
  • FNDAENUMCALLBACK
  • FNDPAENUMCALLBACK
  • FNDSAENUMCALLBACK
  • FNPEER_FREE_SECURITY_DATA
  • FNPEER_SECURE_RECORD
  • FNPEER_VALIDATE_RECORD
  • FN_AUTHENTICATION_CALLBACK
  • FN_AUTHENTICATION_CALLBACK_EX
  • FN_BLUETOOTH_ENUM_ATTRIBUTES_CALLBACK
  • FN_CDF_PARSE_ERROR_CALLBACK
  • FN_CERT_CHAIN_FIND_BY_ISSUER_CALLBACK
  • FN_CERT_DLL_OPEN_STORE_PROV_FUNC
  • FN_CERT_ENUM_PHYSICAL_STORE
  • FN_CERT_ENUM_SYSTEM_STORE
  • FN_CERT_STORE_PROV_CLOSE
  • FN_CERT_STORE_PROV_DELETE_CERT
  • FN_CERT_STORE_PROV_DELETE_CRL
  • FN_CERT_STORE_PROV_READ_CERT
  • FN_CERT_STORE_PROV_READ_CRL
  • FN_CERT_STORE_PROV_SET_CERT_PROPERTY
  • FN_CERT_STORE_PROV_SET_CRL_PROPERTY
  • FN_CERT_STORE_PROV_SET_CTL_PROPERTY
  • FN_CERT_STORE_PROV_WRITE_CERT
  • FN_CERT_STORE_PROV_WRITE_CRL
  • FN_CERT_STORE_PROV_WRITE_CTL
  • FN_CRYPT_XML_CREATE_TRANSFORM
  • FN_CRYPT_XML_DATA_PROVIDER_CLOSE
  • FN_CRYPT_XML_DATA_PROVIDER_READ
  • FN_CRYPT_XML_ENUM_ALG_INFO
  • FN_CRYPT_XML_WRITE_CALLBACK
  • FN_DEVICE_CALLBACK
  • FN_WdsCliCallback
  • FN_WdsCliTraceFunction
  • FN_WdsTransportClientReceiveContents
  • FN_WdsTransportClientReceiveMetadata
  • FN_WdsTransportClientSessionComplete
  • FN_WdsTransportClientSessionStart
  • FN_WdsTransportClientSessionStartEx
  • ForegroundIdleProc
  • FreeMemory
  • FRHookProc
  • FuncReturnhWnd
  • FunctionTableAccessProc64
  • FuncVerifyImage
  • GenerateGroupPolicy
  • GetApplicationRecoveryCallback
  • GetEventMessage
  • GetFirstOrderedService
  • GetGlobalInfo
  • GetInterfaceInfo
  • GetMfeStatus
  • GetModuleBaseProc64
  • GetMsgProc
  • GetNeighbors
  • GetNextOrderedService
  • GetRequest
  • GetResponse
  • GetServiceCount
  • GetSize
  • GetTSAudioEndpointEnumeratorForSession
  • gluNurbsCallback
  • gluQuadricCallback
  • gluTessCallback
  • GopherAttributeEnumerator
  • HandlerEx
  • HandlerRoutine
  • honeCallbackFunc
  • hone_Event
  • HyphenateProc
  • ICMProgressProcCallback
  • ImportCallback
  • InitHelperDll
  • InitializeChangeNotify
  • InitializeEmbeddedUI
  • InitOnceCallback
  • InsertAt
  • InstalluiHandler
  • InstalluiHandlerRecord
  • INSTALLUI_HANDLER
  • InterfaceStatus
  • InternetSetStatusCallback
  • InternetStatusCallback
  • INTERNET_STATUS_CALLBACK
  • IoCompletionCallback
  • IOProc
  • IsService
  • JournalPlaybackProc
  • JournalRecordProc
  • KeyboardProc
  • lineCallbackFunc
  • LineDDAProc
  • Line_Event
  • LOG_FULL_HANDLER_CALLBACK
  • LOG_TAIL_ADVANCE_CALLBACK
  • LOG_UNPINNED_CALLBACK
  • LowLevelKeyboardProc
  • LowLevelMouseProc
  • LPCQADDFORMSPROC
  • LPCQADDPAGESPROC
  • LPCQPAGEPROC
  • LPDISPLAYVAL
  • LPDSENUMATTRIBUTES
  • LPEVALCOMCALLBACK
  • LPFNDFMCALLBACK
  • LPFNVIEWCALLBACK
  • MagGetImageScalingCallback
  • MagImageScalingCallback
  • MagSetImageScalingCallback
  • MappingCallbackProc
  • MaxMediaLabel
  • MessageProc
  • MFAddPeriodicCallback
  • MFInvokeCallback
  • MFPERIODICCALLBACK
  • MFRemovePeriodicCallback
  • MgmCreationAlertCallback
  • MgmDisableIgmpCallback
  • MgmJoinAlertCallback
  • MgmLocalJoinCallback
  • MgmLocalLeaveCallback
  • MgmPruneAlertCallback
  • MgmRpfCallback
  • MgmWrongIfCallback
  • MGM_ENABLE_IGMP_CALLBACK
  • MibCreate
  • MibDelete
  • MIBEntryCreate
  • MIBEntryDelete
  • MIBEntryGet
  • MIBEntryGetFirst
  • MIBEntryGetNext
  • MIBEntrySet
  • MibGet
  • MibGetFirst
  • MibGetNext
  • MibGetTrapInfo
  • MibSet
  • MibSetTrapInfo
  • MidiInProc
  • MidiOutProc
  • MiniDumpCallback
  • MMCFreeNotifyHandle
  • MMCPropertyChangeNotify
  • MMCPropertyHelp
  • MMCPropPageCallback
  • MMIOProc
  • MonitorEnumProc
  • MouseProc
  • MRUCMPPROC
  • MyStatusProc
  • OFNHookProc
  • OFNHookProcOldStyle
  • OpenPerformanceData
  • ORASADFunc
  • OutOfProcessExceptionEventCallback
  • OutOfProcessExceptionEventDebuggerLaunchCallback
  • OutOfProcessExceptionEventSignatureCallback
  • OutputProc
  • PIO_APC_ROUTINE
  • QueryPower
  • RadiusExtensionFreeAttributes
  • RadiusExtensionInit
  • RadiusExtensionProcess
  • RadiusExtensionProcess2
  • RadiusExtensionProcessEx
  • RadiusExtensionTerm
  • RASADFunc
  • RasAdminAcceptNewConnection
  • RasAdminConnectionHangupNotification
  • RasAdminGetIpAddressForUser
  • RasAdminReleaseIpAddress
  • RasCustomDeleteEntryNotify
  • RasCustomDial
  • RasCustomDialDlg
  • RasCustomEntryDlg
  • RasCustomHangUp
  • RasCustomScriptExecute
  • RasDialFunc
  • RasDialFunc1
  • RasDialFunc2
  • RasEapBegin
  • RasEapEnd
  • RasEapFreeMemory
  • RasEapGetIdentity
  • RasEapGetInfo
  • RasEapInitialize
  • RasEapInvokeConfigUI
  • RasEapInvokeInteractiveUI
  • RasEapMakeMessage
  • RasFreeBuffer
  • RasGetBuffer
  • RasPBDlgFunc
  • RasReceiveBuffer
  • RasRetrieveBuffer
  • RasSecurityDialogBegin
  • RasSecurityDialogEnd
  • RasSendBuffer
  • RasSetCommSettings
  • ReaderScroll
  • ReadProcessMemoryProc64
  • RegisterApplicationRecoveryCallback
  • RegisterCallback
  • RegisterProtocol
  • RegisterWaitChainCOMCallback
  • RemoveAt
  • RemoveSecureMemoryCacheCallback
  • RemoveTraceCallback
  • rintHookProc
  • RM_WRITE_STATUS_CALLBACK
  • rocessGroupPolicy
  • rocessGroupPolicyEx
  • rogressNotificationCallback
  • ropEnumProc
  • ropEnumProcEx
  • ropSheetPageProc
  • ropSheetProc
  • RpcAuthKeyRetrievalFn
  • RpcMgmtAuthorizationFn
  • RpcnotificationRoutine
  • RpcObjectInqFn
  • RPC_IF_CALLBACK_FN
  • RtlInstallFunctionTableCallback
  • RTM_ENTITY_EXPORT_METHOD
  • RTM_EVENT_CALLBACK
  • SampleCommand
  • SampleCommit
  • SampleConnect
  • SampleDump
  • SampleOsVersionCheck
  • SampleStartHelper
  • SampleStop
  • SampleStopHelper
  • SceSvcAttachmentAnalyze
  • SceSvcAttachmentConfig
  • SceSvcAttachmentUpdate
  • SecureMemoryCacheCallback
  • SendAsyncProc
  • SendMessageCallback
  • ServiceMain
  • SetAt
  • SetGlobalInfo
  • SetInterfaceInfo
  • SetInterfaceReceiveType
  • SetLineRecoCallback
  • SetPower
  • SetProviderStatusFunc
  • SetProviderStatusInfoFreeFunc
  • SetResponseType
  • SetTraceCallback
  • SetupDefaultQueueCallback
  • SetupHookProc
  • SetupInitDefaultQueueCallback
  • SetupTermDefaultQueueCallback
  • ShellProc
  • ShutdownEmbeddedUI
  • SimpleCallback
  • SNMPAPI_CALLBACK
  • SnmpExtensionClose
  • SnmpExtensionInit
  • SnmpExtensionInitEx
  • SnmpExtensionMonitor
  • SnmpExtensionQuery
  • SnmpExtensionQueryEx
  • SnmpExtensionTrap
  • SoundSentryProc
  • SP_FILE_CALLBACK
  • StackSnapshotCallback
  • StartComplete
  • StartProtocol
  • StatusCallback
  • StatusMessageCallback
  • StatusRoutine
  • StopProtocol
  • SymEnumerateModulesProc64
  • SymEnumerateSymbolsProc64
  • SymEnumLinesProc
  • SymEnumProcessesProc
  • SymEnumSourceFilesProc
  • SymEnumSourceFileTokensProc
  • SymEnumSymbolsProc
  • SymFindFileInPathProc
  • SymRegisterCallback
  • SymRegisterCallbackProc64
  • SymRegisterFunctionEntryCallback
  • SymRegisterFunctionEntryCallbackProc64
  • SyncUpdateProc
  • SysMsgProc
  • TaskDialogCallbackProc
  • ThreadProc
  • TimeProc
  • TimeProvClose
  • TimeProvCommand
  • TimeProvOpen
  • TimerAPCProc
  • TimerCallback
  • TimerProc
  • TranslateAddressProc64
  • TranslateDispatch
  • TrySubmitThreadpoolCallback
  • UiaEventCallback
  • UiaProviderCallback
  • UiaRegisterProviderCallback
  • UmsSchedulerProc
  • UnbindInterface
  • UndeleteFile
  • UnregisterApplicationRecoveryCallback
  • ValidateRoute
  • VectoredHandler
  • VERIFYSERVERCERT
  • WaitCallback
  • WaitChainCallback
  • WaitOrTimerCallback
  • waveInProc
  • waveOutProc
  • WdsTransportClientRegisterCallback
  • WdsTransportProviderCloseContent
  • WdsTransportProviderCloseInstance
  • WdsTransportProviderCompareContent
  • WdsTransportProviderCreateInstance
  • WdsTransportProviderDumpState
  • WdsTransportProviderGetContentMetadata
  • WdsTransportProviderGetContentSize
  • WdsTransportProviderInitialize
  • WdsTransportProviderOpenContent
  • WdsTransportProviderReadContent
  • WdsTransportProviderRefreshSettings
  • WdsTransportProviderShutdown
  • WdsTransportProviderUserAccessCheck
  • WdsTransportServerRegisterCallback
  • WinBioCaptureSampleWithCallback
  • WinBioEnrollCaptureWithCallback
  • WinBioIdentifyWithCallback
  • WinBioLocateSensorWithCallback
  • WinBioVerifyWithCallback
  • WindowProc
  • WinEventProc
  • WinHttpSetStatusCallback
  • WINHTTP_STATUS_CALLBACK
  • WLAN_NOTIFICATION_CALLBACK
  • WorkCallback
  • WPUQueryBlockingCallback
  • xeProviderInitialize
  • xeProviderRecvRequest
  • xeProviderServiceControl
  • xeProviderShutdown
  • xeRegisterCallback

Supporting dynamic Malware Analysis with WinHttp library debug logs (tracing)

Posted on by

Dynamic Malware Analysis is a tricky business. If you don’t use a dedicated sandbox, or an API monitor, it’s often hard to say what’s going on under the hood. Relying on differential analysis may not be enough and having multiple ways to get more information out of the session is always welcome. Process Monitor, DebugView, Performance/EWT logging, etc. are really handy as a support for black-box analysis, and so it is (or may be) enabling of the NtGlobalFlag. In this post I will describe one more hidden flag that can help to trace what’s going on when malware runs.

It turns out that WinHttp library has a built in debugging/tracing mechanism that enables it to log a lot of interesting details and send it either to a file, or directly to a debugger (or both). Lo and behold – it actually has a built-in API monitoring for us! It would be handy if this feature could become an integral part of popular debuggers (or a OllyDbg/Xdbg plug-in).

To enable the logging, you can either add the tracing options directly to Registry under the following key:

  • HKLM\SOFTWARE\Microsoft\Windows\
    CurrentVersion\Internet Settings\WinHttp\Tracing

f.ex. by using a reg file:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\WinHttp\Tracing]
"Enabled"=dword:00000001
"LogFilePrefix"="winhttp"
"ToFileOrDebugger"=dword:00000000
"ShowBytes"=dword:00000001
"ShowApiTrace"=dword:00000001
"MaxFileSize"=dword:01312d00

or use a winhttptracecfg tool which is a part of Windows Server 2003 Resource Kit Tools.

The tool is handy, and we can run it like this:

  • winhttptracecfg -l winhttp -e 1 -d 0 -s 1 -t 1 -m 20000000

Running the tool gives us the following output:

The meaning of the options is as follows:

  • -e : 1: enable tracing; 0: disable tracing
  • -l : [trace-file-prefix], i.e., “C:\Temp\Test3”; or simply: “Test3”
  • -d : 0: output to file; 1: output to debugger; 2: output to both
  • -s : 0: show HTTP headers only; 1: ANSI output; 2: Hex output  (note, this doesn’t seem to work on newer versions of Windows)
  • -t : 1: enable top-level API traces; 0: disable top-level API traces
  • -m : Maximum size the trace file can grow to

and in our case:

  • -e 1 –> TracingEnabled: 1  –> enable tracing
  • -d 0 –> ToFileOrDebugger: 0 –> save to file only
  • -s 1 –> ShowBytes: 1 –> show ANSI output (test on Windows XP)
  • -t 1 –> ShowApiTrace: 1  –> enables API monitoring
  • -m 20000000 –> MaxFileSize: 20000000 –> file should be large enough
  • -l winhttp –> FileNamePrefix: winhttp –> prefix used for a file name

Let’s run a test.

One tool that uses WinHttp library is Autoruns. When you launch it with the tracing enabled you should see a log file immediately or almost immediately created f.ex.:

  • winhttp-autoruns.exe-4020.22.11.42.035-12.15.2016.LOG

where ‘winhttp’ is a prefix we provided in the tracing options, followed by the process name ‘autoruns.exe’, then 4020 which is a PID of the process, then time and date.

The example content looks as below, note that:

  • API calls and their parameters are clearly visible
  • Return values are provided
  • Lots of internal state-related debug info is also provided

(If you don’t see the .log file, check the file / process with VirusTotal)

22:11:42.035 ::>>>> WinHttp Version 6.0 Build 6.1.7601 >>>>Process autoruns.exe [4020 (0xfb4)] started at 22:11:42.035 12/15/2016
22:11:42.035 ::WinHttpOpen("Microsoft-CryptoAPI/6.1", WINHTTP_ACCESS_TYPE_DEFAULT_PROXY (0), "", "", 0x0)
22:11:42.035 ::winhttp-dll added a reference to winhttp.dll (via LoadLibrary() call)
22:11:42.035 ::thread-pool created
22:11:42.035 ::thread pool initialized successfully
22:11:42.035 ::_SvcsStartup() succeeded; async-count = 1
22:11:42.035 ::WinHttpOpen() returning handle 0x38fcb98
22:11:42.035 ::WinHttpSetTimeouts(0x38fcb98, 0, 60000, 60000, 60000)
...
22:15:26.005 ::WinHttpOpen() returning handle 0x39ef730
22:15:26.005 ::WinHttpConnect(0x39ef730, "www.virustotal.com", 443, 0x0)
22:15:26.005 ::Indicate Status 0x39efad0, 0x0, WINHTTP_CALLBACK_STATUS_HANDLE_CREATED (1024), 0x12edd4 [0x39efad0], 4
22:15:26.005 ::WinHttpConnect() returning handle 0x39efad0
22:15:27.066 ::WinHttpOpenRequest(0x39efad0, "POST", "/partners/sysinternals/file-reports?apikey=4e3202fdbe953d628f650229af5b3eb49cd46", "", "", 0x0, 0x00800000)
22:15:27.066 ::Indicate Status 0x395ebe8, 0x0, WINHTTP_CALLBACK_STATUS_HANDLE_CREATED (1024), 0x2cefc84 [0x395ebe8], 4
22:15:27.066 ::WinHttpCreateUrl(0x2cefc20, 0x0, 0x0, 0x2cefc70)
22:15:27.066 ::    WinHttpCreateUrl(); URL = (null), URL Length = 0
22:15:27.066 ::    WinHttpCreateUrl: error 122 [ERROR_INSUFFICIENT_BUFFER]
22:15:27.066 ::WinHttpCreateUrl() returning FALSE
22:15:27.066 ::WinHttpCreateUrl(0x2cefc20, 0x0, 0x2af5b8, 0x2cefc70)
22:15:27.066 ::    WinHttpCreateUrl(); URL = https://www.virustotal.com/partners/sysinternals/file-reports?apikey=4e3202fdbe9, URL Length = 133
22:15:27.066 ::WinHttpCreateUrl() returning TRUE
22:15:27.066 ::WinHttpOpenRequest() returning handle 0x395ebe8
22:15:27.066 ::WinHttpGetProxyForUrl(0x39ef730, "https://www.virustotal.com", 0x2cefd9c, 0x2cefdb4)

On XP, the ShowBytes enables inclusions of the additional data dumps for headers f.ex.:

11:51:55.106 ::*0000001* :: sending data:
11:51:55.106 ::*0000001* :: 177 (0xb1) bytes
11:51:55.106 ::*0000001* :: <<<<-------- HTTP stream follows below ----------------------------------------------->>>>
11:51:55.106 ::*0000001* :: GET /wpad.dat HTTP/1.1
11:51:55.106 ::*0000001* :: Accept: */*
11:51:55.106 ::*0000001* :: User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; .NET5.0C; .NET5.0E)
11:51:55.106 ::*0000001* :: Host: 127.0.0.1
11:51:55.106 ::*0000001* :: Connection: Keep-Alive
11:51:55.122 ::*0000001* :: 
11:51:55.122 ::*0000001* :: 
11:51:55.122 ::*0000001* :: <<<<-------- End ----------------------------------------------->>>>
11:51:55.122 ::*0000001* :: WinHttpSendRequest() returning TRUE
11:51:55.122 ::*0000001* :: WinHttpReceiveResponse(0xaf2000, 0x0)
11:51:55.122 ::*0000001* :: received data:
11:51:55.122 ::*0000001* :: 67 (0x43) bytes
11:51:55.122 ::*0000001* :: <<<<-------- HTTP stream follows below ----------------------------------------------->>>>
11:51:55.122 ::*0000001* :: HTTP/1.1 200 OK
11:51:55.122 ::*0000001* :: Content-Length: 59745
11:51:55.122 ::*0000001* :: Content-Type: text/html
11:51:55.122 ::*0000001* :: 
11:51:55.122 ::*0000001* :: 
11:51:55.122 ::*0000001* :: <<<<-------- End ----------------------------------------------->>>>