---
title: "Get the EVTX file generated during a file’s behavior analysis"
method: GET
path: "/feeds/file_behaviours/{token}/evtx"
tags: ["Sandbox analyses feed"]
---

# Get the EVTX file generated during a file’s behavior analysis

`GET /feeds/file_behaviours/{token}/evtx`

## Request

- Base URL: `https://www.virustotal.com/api/v3`
- URL: `https://www.virustotal.com/api/v3/feeds/file_behaviours/{token}/evtx`
- Auth: none required

## Path parameters

- `token` string, required

## Headers

- `x-apikey` string, required

## Response `200`

200

- object

## Other responses

- `400`: 400

---

[API](https://skmtc.dev/virustotal/apis/ioc-feeds.md) - [All operations](https://skmtc.dev/virustotal/apis/ioc-feeds/llms.txt) - [OpenAPI document](https://skmtc.dev/virustotal/apis/ioc-feeds/revisions/cc5304e754e3?raw)