---
title: "Get the EVTX file generated during a private file’s behavior analysis"
method: GET
path: "/file_behaviours/{sandbox_id}/evtx"
---

# Get the EVTX file generated during a private file’s behavior analysis

`GET /file_behaviours/{sandbox_id}/evtx`

## Request

- Base URL: `https://www.virustotal.com/api/v3/private`
- URL: `https://www.virustotal.com/api/v3/private/file_behaviours/{sandbox_id}/evtx`
- Auth: none required
- TypeScript: <https://skmtc.dev/virustotal/apis/vt-private-scanning/docs/file_behaviours/:sandbox_id/evtx/get.ts> (a function with typed inputs; its response is checked against the schema)

## Path parameters

- `sandbox_id` string, required

## Response `200`

200

- object

## Other responses

- `400`: 400

---

[API](https://skmtc.dev/virustotal/apis/vt-private-scanning.md) - [All operations](https://skmtc.dev/virustotal/apis/vt-private-scanning/llms.txt) - [OpenAPI document](https://skmtc.dev/virustotal/apis/vt-private-scanning/revisions/c1013900ca90?raw)