---
title: "Get the EVTX file generated during a file’s behavior analysis"
method: GET
path: "/file_behaviours/{sandbox_id}/evtx"
tags: ["Files Behaviours"]
---

# Get the EVTX file generated during a file’s behavior analysis

`GET /file_behaviours/{sandbox_id}/evtx`

## Request

- Base URL: `https://www.virustotal.com/api/v3`
- URL: `https://www.virustotal.com/api/v3/file_behaviours/{sandbox_id}/evtx`
- Auth: none required

## Path parameters

- `sandbox_id` string, required

## Headers

- `x-apikey` string, required

## Response `200`

200

- object

## Other responses

- `400`: 400

---

[API](https://skmtc.dev/virustotal/apis/ioc-investigation.md) - [All operations](https://skmtc.dev/virustotal/apis/ioc-investigation/llms.txt) - [OpenAPI document](https://skmtc.dev/virustotal/apis/ioc-investigation/revisions/4d4fadbb8cbc?raw)