Registry Keys that are related to the hash Hosts that the hash communicates with are:ĭomains that the hash communicates with are: 'HKEY_LOCAL_MACHINE\\Software\Microsoft\Rpc\PagedBuffers' '0x000000ac\\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders', '0x00000090\\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders', 'HKEY_LOCAL_MACHINE\\Software\Policies\Microsoft\Windows NT\Rpc', 'HKEY_LOCAL_MACHINE\\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Cmgr.exe\RpcThreadPoolThrottle', 'HKEY_LOCAL_MACHINE\\Software\Microsoft\Windows', 'HKEY_LOCAL_MACHINE\\Software\Microsoft\Rpc', 'HKEY_CLASSES_ROOT\\http\shell\open\command',

'HKEY_LOCAL_MACHINE\\SOFTWARE\Microsoft\VBA\Monitors', Results can number in the thousands, we recommend not using fullResponse in playbooks. You configure the default in the instance settings.

If threshold is not specified, the default file threshold is used. If the number of positives is larger than the threshold, the file is considered malicious. The MD5, SHA-1, and SHA-256 hash of the file whose dynamic behavioral report you want to retrieve Return hashes for a specific IP address: vt-private-hash-communicationĭownload a file: vt-private-download-fileįind out which domains, files, hosts, IP addresses, mutexes, URLs, and registry keys, are associated with a specific file. Get IP address report: vt-private-get-ip-report Get URL report: vt-private-get-url-report Get malicious file report: vt-private-get-file-report Get a domain report: vt-private-get-domain-report Get file dynamic behavioral report: vt-private-check-file-behaviour After you successfully execute a command, a DBot message appears in the War Room with the command details. You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook. IfĪrguments in the command determines how results are returned. : Determines whether to return all results, which can number in the thousands. : The minimum number of highly trusted vendors required to consider a domain IP, URL, or file as malicious. : A CSV list of vendors that are considered trustworthy. If the number of positive results from the VT scanners is bigger than the threshold, the domain is considered malicious. If the number of positive results from the VT scanners exceeds the threshold, the URL is considered malicious. If the number of positive results from the VT scanners exceeds the threshold, the IP address is considered malicious. If the number of positive results from the VT scanners exceeds the threshold, the file will be considered malicious. : a textual name for the integration instance To create and configure a new integration instance. Investigate activity of recognized malware.Ĭonfigure Virus Total - Private API on Cortex XSOAR Get extensive reports on interactions between files, domains, URLs, IP addresses, and hashes. This integration was integrated and tested with Virus Total API v2.0.

Use the Virus Total - Private API integration to investigate suspicious files, domains, URLs, IP addresses, and hashes.

Tim avast passwords activation code